Node.js on 21 October: Four High Fixes in the Runtime
On 21 October, Node.js 26.12.1, 24.22.1, and 22.23.4 patch DNS, TLS hostname checks, and a Brotli decoder bug. The MATA cloud does not run Node.js.
What did the 21 October 2026 Node.js security release fix?
Node.js shipped 26.12.1, 24.22.1, and 22.23.4. The high fixes cover a DNS name that could be cut at an embedded null, certificate hostname checks that could accept a lookalike address, and an out-of-bounds write in the Brotli decoder that can become code execution.
On 21 October 2026 the Node.js project published a security release for the 26, 24, and 22 lines. The highest severity in each line is high. The versions are 26.12.1, 24.22.1, and 22.23.4. The advisory is the Node.js 21 October security release.
Four highs sit in the runtime people embed and then forget: DNS, two certificate hostname checks, and the Brotli decoder. The MATA cloud does not run that runtime. This note says what broke, what Rust does and does not promise, and where to read the rest of the day: PHP2Shell, the GitLab compiler patch, and the Cloudflare edge incident.
How the Node.js bugs showed up
Node is a JavaScript runtime wired to C libraries for names, TLS, and compression. A defect in those edges is a defect in every app that trusted the runtime to do the boring part. The October release is that class of fix, plus dependency bumps for c-ares, the CA bundle, and, depending on the line, OpenSSL, SQLite, and Undici.
What the runtime got wrong
CVE-2026-105482 is high on 26, 24, and 22. dns.resolve could truncate a name that contained a NUL character, so the lookup that happened was not the name the caller wrote. CVE-2026-105483 is high on 26 and 24: a certificate hostname check could be bypassed when an IP address was written with fullwidth digits. CVE-2026-106069 is high on all three lines: a hostname that loosely resolves to an IP address could slip past the check that should have bound the certificate to the destination. CVE-2026-111497 is high on all three lines. The Brotli decoder can write outside its buffer, and the advisory says that permits remote code execution when the process handles untrusted compressed bytes.
None of those sentences is a recipe. They are the names and the impact, which is enough to decide whether you run Node and whether you decompress bytes you did not create.
Who has to move
Anyone on 26, 24, or 22 should move to 26.12.1, 24.22.1, or 22.23.4. End-of-life majors do not get the fix. The same drop includes medium bugs: a keep-alive socket that can process a response written before the request was sent (CVE-2026-105481), another non-canonical IPv4 hostname gap (CVE-2026-106072), and crypto.randomUUID plus randomInt values that repeat when they were captured into a startup snapshot or a single executable (CVE-2026-106074). Low items cover a ZIP reader and the experimental permission model. Treat the highs as the reason to upgrade tonight, and the rest as reasons the upgrade is the whole release, not one file.
Why a Rust rebuild is a different shape
The Importance of Remade With Rust is the argument that the runtime itself should be something you can warranty. Node's October list is a runtime list. The application author did not write the Brotli loop or the hostname parser. They inherited both.
The class of bug
An out-of-bounds write in a C decoder is the memory class Rust's safe subset is built to refuse. A NUL truncated inside a string is the sort of string model Rust's strings do not use, because a Rust String is not a C buffer that ends at the first zero. Hostname comparison is different. It is a policy bug. Rust will compile a wrong comparison as happily as it compiles a right one. Saying the MATA cloud is safe from CVE-2026-106069 means we do not run Node's checker. It does not mean every future certificate check in every language is finished work. Cargo update is not a security model makes the matching point for dependencies: a bump is hygiene, not a design.
What we ship instead
Compression in the Remade catalog is rusty_zstd, a Rust remake of the Zstandard job, not Node's bundled Brotli. Name lookup and TLS for our services sit in Rust stacks we build, not in the Node binary. The foundation piece is rebuilding the foundation of the internet.
How the MATA cloud stays off this path
mata.network does not serve the mesh from Node.js, so these ten CVEs are not bugs in that cloud. There is no Node Brotli decoder on the request path, and no Node DNS helper cutting names. The field note is MATA.NETWORK in the wild. Household devices on dldeploy.com are ESP32 firmware in the Remade crates, not a Node process, which is the story in dldeploy in the wild. Document work on ragconverter.com stays in the local Rust tools in ragconverter in the wild. House news is futureweb.news.
The house does not run that runtime
If a side tool on a laptop still runs Node, patch that tool. The cloud path people join on mata.network is not waiting on 26.12.1 to become safe from this list. The map is Vision.
What to do if you still ship Node
Upgrade the supported lines. Rebuild any container whose base image froze an older Node. If you decompress untrusted Brotli, do that upgrade before the rest of the queue. Then ask whether that service needs Node at all. The rest of today's record is PHP2Shell, GitLab, and Cloudflare.
FAQ
Quick answers for builders evaluating this technology.
Which Node.js versions received the 21 October fixes?
26.12.1 on the current line, 24.22.1 on the 24 LTS line, and 22.23.4 on the 22 LTS line. End-of-life Node lines stay affected. The project lists high as the top severity on all three supported lines.
Is the Brotli issue the one that can run code?
CVE-2026-111497 is the high bug in Node's Brotli decoder: an out-of-bounds write that the advisory says permits remote code execution. Applications that decompress untrusted Brotli data are the ones to patch first. The notice does not spell out a single reliable trigger, and this note will not invent one.
Do the TLS bugs mean Rust checks hostnames for you?
No. CVE-2026-105483 and CVE-2026-106069 are mistakes in Node's own certificate hostname checks. Safe Rust does not automatically know what a hostname is. The protection is that the MATA cloud does not ship Node's checker. Certificate logic still has to be correct in whatever stack you run.
What else landed in the same Node.js release?
Medium issues include a keep-alive socket that could accept a response written before its request, a further hostname-validation gap, and random values repeated from a startup snapshot. Low issues touch ZIP bytes and the permission model. The release also bumps c-ares, certificates, and, on some lines, OpenSSL, SQLite, and Undici.
Where should a builder read the Node.js October release note?
The Node.js 21 October advisory, then mata.network, the PHP2Shell note, the GitLab compiler note, and rusty_zstd for compression that is not Node's Brotli decoder.