Node.js October 2026 Security Releases: alt-nodejs Updates for CloudLinux (CVE-2026-111497 and 9 Others)

Node.js released v22.23.4, v24.22.1, and v26.12.1 on October 21, 2026. Together they fix 10 CVEs across the HTTP, DNS, TLS, crypto, and permission-model code, plus the Brotli decoder. Four are rated High, three Medium, and three Low.

CloudLinux ships Node.js to hosting accounts through Node.js Selector, as alt-nodejs packages. A fix from nodejs.org therefore reaches your accounts only when we rebuild those packages and you install them. The same applies to ea-nodejs22 (cPanel) and to the TuxCare, Debian, Ubuntu, and Alpine builds.

Why this matters on a shared host

On a shared server the Node.js version belongs to each account’s application, not to you. Anyone who can send that application data it will decode, parse, or validate can reach the runtime underneath it. The High-rated issues cover the Brotli decoder, DNS name handling, and TLS hostname checks, so exposure depends on what each application does with network input.

Upstream does not patch end-of-life Node.js lines, and those are the versions most likely to sit forgotten on older accounts. CloudLinux has released updated packages for the end-of-life lines 10, 12, 14, 16, 18, 19, and 20. alt-nodejs6, alt-nodejs8, alt-nodejs9, and alt-nodejs11 are not patched.

Which versions are affected?

Every Node.js line in the CloudLinux repositories is affected. The table shows where each line stands.

Debian, Ubuntu, and Alpine builds are listed per package. The CloudLinux column covers Ubuntu 22.04.

Which of the 10 CVEs apply depends on the line. CVE-2026-106070 applies to 26.x only, and CVE-2026-105483 applies to 26.x and 24.x. Upstream lists CVE-2026-106071 for 26.x only, but our engineers reproduced it on 22.x and 24.x and fixed it there in release 2 of alt-nodejs22 and alt-nodejs24. The full list is in the section on what the releases fix.

Is there a mitigation?

No workaround for CVE-2026-111497 is documented upstream. The fix is the updated package.

Updating the system brotli package does not fix it. alt-nodejs packages carry their own copy of Brotli, so only an updated alt-nodejs package closes the issue.

Until the fixed package for your Node.js line is available, the practical way to limit exposure to the Brotli issue is to avoid decoding Brotli data from sources you do not control. That means reviewing applications that fetch compressed content from third-party servers or accept compressed uploads. This reduces risk and does not remove it.

Update instructions

Fixed packages are available for alt-nodejs 10, 12, 14, 16, 18, 19, 20, 24, and 26 on CloudLinux, for alt-nodejs22 on CloudLinux 8 and 9, and for ea-nodejs22 (cPanel) on CloudLinux 8. The tables above list the platforms each one covers. If you updated alt-nodejs22 or alt-nodejs24 before 26 October, update again to get release 2.

Fixed packages go straight to the stable repositories, so no testing-channel step is needed. CageFS does not need a manual update.

# See which alt-nodejs packages are installed
rpm -qa 'alt-nodejs*'

# Update them
yum update 'alt-nodejs*'

On CloudLinux for Ubuntu 22.04:

apt-get update && apt-get install --only-upgrade 'alt-nodejs*'

On cPanel servers on CloudLinux 8, update ea-nodejs22:

dnf upgrade ea-nodejs22

Running applications keep using the old binary until they restart. After updating, restart the Node.js applications on each account, either from Node.js Selector or with:

cloudlinux-selector restart --json --interpreter nodejs --user <user> --app-root <app_root>

How to verify you are patched

End-of-life lines keep their upstream Node.js version, so node –version does not change after the update. Check the package release instead:

rpm -q alt-nodejs16-nodejs

On CloudLinux for Ubuntu 22.04, use dpkg-query -W alt-nodejs16-nodejs. On an end-of-life line the package is fixed if its release is at least the value in the table. On 22, 24, and 26 it is fixed at the version shown or any later version.

On the supported lines, the Node.js version also reads v22.23.4, v24.22.1, or v26.12.1 or later once the package is fixed.

The rest of this advisory is background for readers who want it: the full list of fixes and the dependency updates in these releases. Neither is required to apply the update above.

What the October 2026 Node.js releases fix

Severity is as rated upstream. The Node.js advisory does not publish CVSS scores or per-CVE fixed versions; it lists the three fixed releases above.

The Brotli fix includes a cherry-picked upstream Brotli commit. The three TLS issues and the DNS issue matter most to applications that validate certificates for outbound connections or resolve names taken from untrusted input.

Dependency updates in the same releases

Alongside the CVE fixes, upstream updated bundled dependencies:

• c-ares: 26.x, 24.x, 22.x
• Root certificates (including a change for the eMudhra Intermediate CA compromise): 26.x, 24.x, 22.x
• OpenSSL: 24.x, 22.x
• SQLite: 22.x
• Undici: 26.x, 24.x, 22.x

References

• Node.js: October 2026 security releases
• Node.js v24.22.1 release notes
• CloudLinux status page incident
• Need help? Contact CloudLinux support