Node.js shipped security releases on 21 October 2026: v22.23.4, v24.22.1, and v26.12.1. They fix 10 CVEs, four rated High. The one to care about on a hosting server is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that upstream says permits remote code execution. There is no workaround.
CloudLinux published fixed alt-nodejs packages on 22 October for every line it ships, including the end-of-life ones. If you run Node.js Selector for customers, update the packages and restart their apps. Installing the RPM alone does not patch a running process.
The CVEs
| CVE | Issue | Severity |
|---|---|---|
| CVE-2026-111497 | Brotli decoder out-of-bounds write (RCE) | High |
| CVE-2026-105482 | dns.resolve truncates names containing NUL | High |
| CVE-2026-105483 | TLS hostname bypass with fullwidth-digit IPs (24.x, 26.x) | High |
| CVE-2026-106069 | TLS hostname bypass when the host loosely resolves to an IP | High |
| CVE-2026-105481 | Keep-alive socket accepts a response sent before the request | Medium |
| CVE-2026-106072 | DNS SANs can authenticate non-canonical IPv4 endpoints | Medium |
| CVE-2026-106074 | randomUUID() entropy cache saved into snapshots and SEAs | Medium |
| CVE-2026-106070, 106071, 106073 | ZipFile prefix bytes and two Permission Model bypasses | Low |
The releases also bump c-ares, OpenSSL (22.x and 24.x), SQLite (22.x), Undici, and the CA bundle, dropping the compromised eMudhra intermediate.
Fixed alt-nodejs releases
A package is fixed when its RPM release number is at least the value below.
| Package | Minimum release | Package | Minimum release |
|---|---|---|---|
| alt-nodejs12 | 35 | alt-nodejs22 | 2 |
| alt-nodejs14 | 37 | alt-nodejs23 | 23 |
| alt-nodejs16 | 33 | alt-nodejs24 | 2 |
| alt-nodejs18 | 26 | alt-nodejs26 | 1 |
| alt-nodejs20 | 15 |
alt-nodejs22 for CloudLinux 7 followed late on 22 October, and patched alt-nodejs10 and alt-nodejs19 reached stable on 23 October. Fixes go straight to the stable repositories, so you don't need the testing channel.
Update and restart
rpm -qa 'alt-nodejs*'
yum update 'alt-nodejs*'
CageFS picks up the new binaries without a manual cagefsctl --force-update. Running Passenger apps keep the old binary in memory until they restart. Restart them from Setup Node.js App in cPanel, or per app from the shell:
cloudlinux-selector restart --json --interpreter nodejs --user jdoe --app-root myapp
Then verify. On supported lines node --version should report v22.23.4, v24.22.1, or v26.12.1. End-of-life lines keep their original upstream version string, so check the RPM release with rpm -q alt-nodejs18 instead.
cPanel ea-nodejs22
cPanel ships its own ea-nodejs22 for Application Manager. CloudLinux released ea-nodejs22 22.23.4-1 for CloudLinux 8 with hardened ea-php on 22 October. The standard EasyApache 4 build was still pending at the time of writing, and the last EasyApache 4 release we could confirm carried 22.23.3. Check with rpm -q ea-nodejs22 and run yum update ea-nodejs22 once 22.23.4 lands. Keep cPanel update tiers in mind if a box isn't pulling EasyApache updates.
What is CVE-2026-111497 in Node.js?+
Are end-of-life alt-nodejs versions patched on CloudLinux?+
Do I need to restart Node.js apps after updating alt-nodejs?+
Is there a workaround for the Node.js Brotli vulnerability?+
Next steps
- Patch PHP too: the same week brought PHP2Shell, CVE-2026-109618 and CVE-2026-109619.
- Check the kernel side with the Infinity Core CVE-2026-98260 advisory.
- Need Node.js Selector on more servers? Add a CloudLinux license.