Security Alert: Critical Remote Code Execution Vulnerabilities in Node.js

Node.js has released security updates to address multiple vulnerabilities, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, and CVE-2026-111497, that could allow remote attackers to cause denial of service, bypass security restrictions, disclose sensitive information, or execute arbitrary code on affected systems. 

Affected Systems

The following system versions are affected:

• Node.js 22: versions prior to 22.23.4 (LTS)

• Node.js 24: versions prior to 24.22.1 (LTS)

• Node.js 26: versions prior to 26.12.1 (Current)

Security Risks

The identified critical vulnerabilities could allow attackers to execute arbitrary code, cause denial of service, bypass security restrictions, and disclose sensitive information on affected systems. Successful exploitation could lead to service disruption, unauthorized access, and compromise of system integrity and confidentiality. 

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and system administrators to:

1. Update Node.js to a fixed version as soon as possible to address the identified critical vulnerabilities and protect affected servers from potential exploitation.
   
   The recommended software versions to upgrade to are as follows:

• Node.js 22: Update to Node.js version 22.23.4 (LTS)

• Node.js 24: Update to Node.js version 24.22.1 (LTS)

• Node.js 26: Update to Node.js version 26.12.1 (Current)

2. Before performing any update tasks, ensure that you have a backup of your data.

For further information and support, please contact the National Cyber Security Authority (NCSA) by email to rwcsirt@ncsa.gov.rw or call us on 9009

References

• Nodejs Security Advisory 

• Security-bulletin/node-js-multiple-vulnerabilities

• Nodejs.org