Closed Circuit Consultants · Las Vegas, NV · remote US
Node.js upgrades from Node 12 onward, to an LTS line that still gets security fixes.
We move apps on Node 12, 14, 16, 18, and 20 to Node 22.23.4 or 24.22.1 and later, including the dependencies and native modules that block the move.
On 21 October 2026 Node.js fixed 10 CVEs in 22.23.4, 24.22.1, and 26.12.1. The worst, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder. Node 20 and older are affected and get no fix.
Free 30-minute call. Written findings in 48 hours that you keep. Then a scoped SOW.
How it starts
Call → 48h upgrade findings → scoped upgrade
- 1. Free 30-minute call. We go over which Node.js runs where, how you build and deploy, and who owns production.
- 2. 48-hour findings you keep. We record the Node.js version on every server, container, CI runner, and function, and list each package and native module that blocks the target. The findings also say what your tests cover, which LTS line to target, and the order of work.
- 3. Scoped upgrade. Fixed price for the upgrade, or from $2,500/month if you want us in the repo after.
Where Node.js support stands
From the October 2026 Node.js security release. An end-of-life line gets no fix from the Node.js project when the next bug lands.
| Line | Status | October 2026 fix |
|---|---|---|
| 20 and older | End of life | None. Always affected. |
| 22 | LTS, supported | 22.23.4 |
| 24 | LTS, supported | 24.22.1 |
| 26 | Current | 26.12.1 |
The 21 October 2026 security release
The Node.js project fixed 10 CVEs in 22.23.4, 24.22.1, and 26.12.1.
- CVE-2026-111497, Brotli decoder. An out-of-bounds write in the Brotli decoder bundled with Node.js. Attacker-supplied Brotli data decompressed through node:zlib can corrupt memory, which can crash the process, disclose memory, or run code remotely. Node.js rates it High. Singapore's CSA alert AL-2026-154 scores it CVSS 9.8, critical. NHS England's alert CC-4881 reports a public proof-of-concept. CERT Santé notes that fetch() decodes Brotli-encoded responses on its own.
- Also High. CVE-2026-105482: dns.resolve* truncates hostnames at a NUL byte, which can bypass an allowlist. CVE-2026-105483: TLS hostname checks bypassed with fullwidth-digit IP addresses, 24.x and 26.x only. CVE-2026-106069: TLS hostname checks bypassed with leading-zero IPv4 addresses.
- Medium. CVE-2026-106072, where a non-canonical IPv4 address lets a certificate with a DNS SAN authenticate an IP endpoint. Also CVE-2026-105481 and CVE-2026-106074.
- Low. CVE-2026-106070, CVE-2026-106071, and CVE-2026-106073.
Until you are patched, do not decompress untrusted Brotli input. That means request bodies, and fetch responses from servers you do not control.
What usually breaks on the way
Native modules
Packages with C or C++ add-ons are built for one Node.js major. On a new one they rebuild with node-gyp, and old releases of some packages will not build at all. We move those to a release that builds, or replace them.
Deprecated APIs
Calls that were deprecated on the old line warn or are gone on the new one. A test run on the target version with --throw-deprecation finds them in your code and in your dependencies.
OpenSSL changes
Newer Node.js lines ship a newer OpenSSL. Old build tools, hash calls, keys, and certificates that it rejects stop working, sometimes only in production.
Dependencies
Old packages pin engine ranges or rely on behavior that changed. The findings list every package that blocks the target and what replaces it, in the order the upgrades have to happen.
Proof
Who does the work
Sean O'Dea, CISSP, GPEN.
Worried a dependency is poisoned, not just old? See the supply-chain compromise check. Want the code reviewed for more than the Node.js version? See security in the build.
Questions
Which Node.js versions do you upgrade from?
Node 12, 14, 16, 18, and 20. The older the version, the more the findings cover, but none of them are too old to move.
Which Node.js version should we upgrade to?
A supported LTS line: Node 24.22.1 or later, or Node 22.23.4 or later when a dependency is not ready for 24. Node 26 is the Current line, not LTS.
Are we exposed to the October 2026 Node.js security bugs?
If anything you run is on Node.js older than 22.23.4, 24.22.1, or 26.12.1, it is missing the fixes from the 21 October 2026 Node.js security release. Node 20 and older are affected and get no fix. The worst bug, CVE-2026-111497, is reached when the app decompresses attacker-supplied Brotli data with node:zlib, and fetch() decodes Brotli-encoded responses on its own.
Can you reduce our exposure while the upgrade is planned?
Yes. Until the app is on a patched release, we stop it decompressing untrusted Brotli input: request bodies, and fetch responses from servers you do not control. That covers the Brotli bug only, not the DNS and TLS bugs, so the upgrade still happens.
What breaks when we move to a newer Node.js?
Usually native modules that need a node-gyp rebuild, calls to deprecated APIs, and code or certificates that the newer OpenSSL rejects. The findings list every package that will not run on the target version and what replaces it.
Can the app stay up during the upgrade?
Yes. The upgraded app runs next to the old one on the new Node.js first. Cutover happens in a window you pick, and the old runtime stays available as a rollback until you sign off.
What does it cost, and how long does it take?
We do not quote either before the findings. The 30-minute call is free. The 48-hour findings become a scoped SOW: a fixed price for the upgrade, or a retainer from $2,500/month if you want us in the repo after.
Get back on a Node.js line that gets patched.
Book the free call. Bring the output of node -v from production.
Closed Circuit Consultants · SOC LLC d/b/a · Las Vegas, NV · remote across the US