Node.js has released security updates for its 22.x, 24.x, and 26.x supported release lines on October 21, 2026. These updates address multiple vulnerabilities impacting key functionalities. The affected areas include the Brotli decoder, DNS resolution, and TLS certificate validation. Some vulnerabilities carry a high Security Impact Rating. Specifically, CVE-2026-111497 allows for potential remote code execution due to an out-of-bounds write in the Brotli decoder. CVE-2026-105482 relates to DNS resolution truncation when NUL characters are embedded. Two vulnerabilities, CVE-2026-105483 and CVE-2026-106069, permit TLS hostname validation bypasses using fullwidth IP digits or noncanonical IP addresses respectively. These vulnerabilities pose risks of remote code execution and traffic interception. Cisco has confirmed that products not listed in their advisory are not affected. The advisory will be updated as more information becomes available.