Ten fixes across Node.js 22, 24 and 26, including a Brotli decompression bug that can lead to remote code execution and two ways to slip past TLS hostname checks. Who is actually exposed, the versions to move to, and what that means for Lambda, ECS, EKS and Beanstalk.
On October 21, 2026, the same day as PHP2Shell, the Node.js project shipped security releases for the 22.x, 24.x and 26.x lines, fixing ten vulnerabilities. Four are rated high.
From the Node.js security release notes, October 21, 2026.
The fixed versions are 26.12.1, 24.22.1 and 22.23.4. Node.js 20 and older are end of life: they are affected and receive no fix.
CVE-2026-111497 needs your process to decompress Brotli data that an attacker controls. That is more common than it sounds:
APIs or middleware that accept request bodies with Content-Encoding: br and inflate them.
Services that fetch URLs a user supplied — webhooks, link previews, importers, scrapers — and let the HTTP client decode a Brotli response.
Anything that calls zlib's Brotli decompression on uploaded files or messages from a queue other parties can write to.
If none of those apply, your risk from this one is lower — but the TLS hostname bypasses affect any service making outbound TLS connections to addresses influenced by input, and the upgrade fixes all ten at once. Don't triage; upgrade.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Functions on the managed nodejs22.x, nodejs24.x and nodejs26.x runtimes with runtime management left on Auto are moved to patched runtime versions by AWS as they roll out — check the runtime version in your function's logs or in the console rather than assuming. Functions you pinned with Manual runtime management, functions packaged as container images, and anything still on nodejs20.x are your responsibility: update the pin, rebuild the image, or migrate off Node.js 20, which gets no fix at all.
Rebuild on a patched base — node:22.23.4, node:24.22.1 or node:26.12.1, or your distro's equivalent — and roll the services. Images built FROM node:22 last month carry the old binary until they are rebuilt. ECR enhanced scanning and Amazon Inspector will list the images that still have a vulnerable Node.js.
Apply the Node.js platform update in Beanstalk (or wait for managed updates if you can accept that window), redeploy App Runner services built from source so they pick up the patched runtime, and update Node on EC2 through your package manager or nvm — then restart the process.
Keep an inventory of every Node.js runtime you run, by version. If finding them took more than an hour this week, that is the first thing to fix.
Rebuild container images on a schedule, not only when a CVE forces it — a weekly rebuild makes a release like this a non-event.
Get off Node.js 20. It will be affected by every future Node.js vulnerability and fixed for none of them.
Subscribe to the nodejs-sec mailing list: releases are pre-announced, so you can plan the upgrade before the details are public.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Amazon Linux 2 End of Life (June 30, 2026): What on AWS Still Runs It and Where to Move
Amazon Linux 2 stopped receiving standard security updates on June 30, 2026, but it is still inside EC2 fleets, ECS and Batch compute environments, old EKS node groups, retired Elastic Beanstalk platforms, Lambda runtimes and container base images. Where to look, the Lambda dates that matter (Python 3.10 deprecates on October 31), and what changes moving to AL2023.
Read
One Wednesday in October: PHP, Node.js and LiteLLM, and What It Says About Patch Speed
On October 21, 2026 two critical PHP flaws were disclosed after being exploited for four days, Node.js shipped ten security fixes, and LiteLLM, the gateway holding many companies' AI API keys, published a release with a credential stealer inside. What that day teaches about how fast "fast" now has to be.
Read
As of October 24, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.