Node.js October 2026 Security Fixes: Already Patched in Saphira Linux

These are upstream Node.js defects, not defects originating in Saphira Linux. The October 2026 releases address DNS, TLS hostname verification, HTTP keep-alive, Brotli, permission-model and crypto-entropy issues, plus bundled dependency updates (c-ares, OpenSSL sources, SQLite, Undici, root certificates, timezone data).

• CVE-2026-105482 (High): dns.resolve truncated names containing a NUL byte instead of rejecting them.
• CVE-2026-105483 (High, 24.x only): TLS hostname verification could be bypassed when an IPv4 address was written with fullwidth digits.
• CVE-2026-106069 (High): TLS hostname verification could validate against a different IP than the one connected to for non-canonical IPv4 spellings with a leading zero.
• CVE-2026-111497 (High): Bundled Brotli decoder out-of-bounds write on malformed input.
• CVE-2026-105481 (Medium): HTTP keep-alive could accept a response written before the request was sent.
• CVE-2026-106072 (Medium): TLS accepted a DNS-only SAN for an IP endpoint reached via a non-canonical IPv4 spelling.
• CVE-2026-106074 (Medium): Crypto entropy caches could be baked into startup snapshots / single-executable applications, repeating UUID and random-int values across processes.
• CVE-2026-106073 (Low): Permission model left fs.realpathSync without the required read checks.

CVE-2026-106070 and CVE-2026-106071 affect the 26.x line only and are not applicable to the Saphira-packaged 24.x and 22.x runtimes. Saphira does not ship a Node.js 26.x package.

• Node.js 24.22.1, verified as Saphira's signed nodejs-24.22.1-r1 package (with matching -dev and -doc subpackages and bundled npm 11.19.1).
• Node.js 22.23.4, verified as Saphira's signed nodejs22-22.23.4-r1 package (with matching -dev subpackage and bundled npm22).

Bundled dependency versions observed in the shipped binaries match the upstream fixed releases: c-ares 1.34.9, Undici 7.30.1 (24.x) / 6.29.1 (22.x), SQLite 3.53.4 and timezone 2026e on both lines. Saphira builds link the system OpenSSL (observed 3.6.3) via --shared-openssl, so the bundled-openssl source bump in the upstream notes does not directly apply to these binaries.

Before publishing, we confirmed the signed packages install and upgrade cleanly, that the installed programs report the fixed versions (v24.22.1 and v22.23.4), and that the important new behaviours are present: for example, misleading host spellings are now rejected and invalid DNS names are refused instead of being silently truncated.

Two of the upstream fixes (the keep-alive timing issue and the snapshot entropy cache) cannot be demonstrated with a simple local test, so those are covered by shipping the exact upstream releases rather than by a hands-on check.

AKADATA LIMITED provides Node.js maintenance, security updates, code reviews, performance improvements and application modernisation. Contact us if your infrastructure or application needs engineering assistance.

This is an optional commercial service, not a requirement for using Saphira Linux. Contact AKADATA LIMITED support →