Node.js October 2026 security releases — Advisory

Published: [October 23, 2026]

CVE ID: CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069 (High); CVE-2026-105481, CVE-2026-106072, CVE-2026-106074 (Medium); CVE-2026-106070, CVE-2026-106071, CVE-2026-106073 (Low)

Severity: High

Absolute product status: Not affected. No customer action required.

Overview

On October 21, 2026, the Node.js project published its scheduled security release for the 26.x, 24.x and 22.x lines, fixing 10 vulnerabilities: 4 rated High, 3 Medium and 3 Low. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that can permit remote code execution. These vulnerabilities sit in specific Node.js features, so not every Node.js installation is exposed. Absolute Security has assessed its products and services. Absolute products are not affected, and no customer action is required.

Key Facts:

  • Absolute Secure Endpoint, RfA, RfS, Syxsense and FirmGuard are not affected. Absolute Secure Access: self-hosted versions of the Secure Access bandwidth server are not vulnerable to the described issues. Out of an abundance of caution, we will also apply a patch to self-hosted bandwidth server as part of a forthcoming Secure Access update. and all cloud (SaaS) instances of the Secure Access bandwidth server have already been patched.
  • Absolute Insights for Network: versions earlier than 4.50 include a version of Node.js that is not susceptible to known attacks. Node.js was removed from Insights for Network entirely in version 4.50, which is shipping now.

Recommended Remediation

  • For Absolute products, no action is required.
  • For Node.js in your own environment, update to v26.12.1, v24.22.1 or v22.23.4. End-of-life Node.js versions are affected and receive no fix. Test before you deploy, because Node.js upgrades can break applications. Rebuild any container images that embed an affected runtime.
  • Reference: Node.js October 21, 2026 security releases
  • Reference: Node.js v26.12.1, v24.22.1, v22.23.4

How Absolute Can Help

  • For Absolute Resilience for Automation, Absolute Resilience for Security and Syxsense customers, published detection and patching content is available to find affected installations and apply the fixed release.
  • For Absolute Secure Endpoint customers, the ‘Detect Node.js runtimes affected by the October 2026 security release’ Reach script detects Node.js installations and versions across your Absolute-managed devices.