nodejs-october-2026-security-releases: Wednesday, October 21, 2026 Security Releases

Published Oct 21, 2026

Updated

Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues.

This security release includes the following dependency updates to address public vulnerabilities:

c-ares on 26.x, 24.x, 22.x

ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x

OpenSSL on 24.x, 22.x

SQLite on 22.x

Undici on 26.x, 24.x, 22.x

Affected Software

5 affected components

OpenJS Foundation Node.js=22.x, =24.x, =26.x

c-ares c-ares=22.x, =24.x, =26.x

OpenSSL OpenSSL=22.x, =24.x

SQLite SQLite=22.x

OpenJS Foundation Undici=22.x, =24.x, =26.x

Event History

Oct 21, 2026

Advisory Published

via Node.js·10:00 PM

Data Sourced

via Node.js·10:00 PM

Description

Child vulnerabilities

Contains the following vulnerabilities.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

Which Node.js release lines received updates for each affected dependency?

c-ares, ca-cert, and Undici updates are available for Node.js 26.x, 24.x, and 22.x. OpenSSL updates are available for 24.x and 22.x, while SQLite updates are available for 22.x only.

Are all listed dependency updates relevant to Node.js 26.x?

No. Node.js 26.x includes updates for c-ares, ca-cert, and Undici, but the provided release information does not list OpenSSL or SQLite updates for that release line.