TL;DR On October 21, 2026, the Node.js project shipped versions 22.23.4, 24.22.1 and 26.12.1 to fix 10 vulnerabilities. This Node.js security release patches four high-severity flaws, including a Brotli decoder bug that "permits remote code execution." It also drops trust in the compromised eMudhra certificates. Why It Matters Node.js runs countless web servers, APIs and build tools. Three of the high-severity bugs weaken TLS hostname checks, which protect connections from impersonation.