2026-10-28, Version 26.13.0 'Lithium' (LTS), @richardlau
2026-10-29T08:51:48Z•6ea99760bc244626ab3eafa3ea653c5495b034f60792289ee1841a2865a98b8c
CVE-2026-105481CVE-2026-105482CVE-2026-105483CVE-2026-106069CVE-2026-106073CVE-2026-106074CVE-2026-111497BrotliDNSHTTPLTSNode.jsTLSV8cryptopermission modelsecurity release
What happened
Node.js release feed covering October 2026 updates. Security releases 26.12.1, 24.22.1, and 22.23.4 address high- and medium-severity issues in TLS IP validation, DNS null-byte handling, HTTP agent guards, permission checks, crypto random-cache handling, and Brotli processing. Node.js 26.13.0 transitions the 26.x line to LTS through April 2029, while 24.22.2 provides follow-up dependency and stream changes.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- nodejs_node_releases
- Record identifier
- 6ea99760bc244626ab3eafa3ea653c5495b034f60792289ee1841a2865a98b8c
- Enrichment time
- 2026-10-29T08:51:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.