WhatBrokeToday
Today's Trends
minorInvestigatingNode.jsv22.23.4 (LTS)

nodejs/node 22.23.4 'Jod' (LTS), Production Release

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

A production release of nodejs/node version 22.23.4 'Jod' has been deployed to address several security vulnerabilities and improve agent data guard, DNS validation, TLS handling, permission checks, random cache resets, and realpathSync functionality.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Under active investigation. No report has identified a root cause yet.

Evidence

3 reports · 3 GitHubShow
  1. [1]
    GitHub First report
    nodejs/node 2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95: security release(opens GitHub issue in a new tab)

    This is a security release. Notable Changes (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina) (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) (CVE-2026-111497) src: expose…

    by aduh95 9upvotes 0comments

  2. [2]
    GitHub
    nodejs/node 2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95: security release(opens GitHub issue in a new tab)

    This is a security release. Notable Changes (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina) (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) (CVE-2026-106074) crypto: reset random caches across snapshots…

    by aduh95 24upvotes 0comments97% match

  3. [3]
    GitHub
    nodejs/node 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS: security release(opens GitHub issue in a new tab)

    This is a security release. Notable Changes (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) –…

    by aduh95 30upvotes 0comments96% match

Timeline

  1. First report on GitHub issue

    nodejs/node 2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95: security release

    Source