The short answer
Run node -v. The Node.js security release of 21 October 2026 fixes 10 vulnerabilities, 4 of them rated high, in versions 26.12.1, 24.22.1 and 22.23.4. If your version is older on the 26, 24 or 22 line, update with the tool that installed Node: brew upgrade node for Homebrew, nvm install 24.22.1 for nvm, volta install node@24.22.1 for Volta, fnm install 24.22.1 for fnm, mise use -g node@24.22.1 for mise, or the installer from nodejs.org (use the version for your line). The same versions also update Node's built-in certificate list for the eMudhra incident.
On this page
What the release fixes
| CVE | What it is | Lines affected |
|---|---|---|
| CVE-2026-105482 | dns.resolve truncates names containing a NUL character. | 26, 24, 22 |
| CVE-2026-105483 | TLS certificate hostname check bypassed when the IP address is written with fullwidth digits. | 26, 24 |
| CVE-2026-106069 | TLS certificate hostname check bypassed when the host loosely resolves to an IP address. | 26, 24, 22 |
| CVE-2026-111497 | Out-of-bounds write in the Brotli decoder that permits remote code execution. | 26, 24, 22 |
CVE-2026-105482
- What it is
dns.resolvetruncates names containing a NUL character.- Lines affected
- 26, 24, 22
CVE-2026-105483
- What it is
- TLS certificate hostname check bypassed when the IP address is written with fullwidth digits.
- Lines affected
- 26, 24
CVE-2026-106069
- What it is
- TLS certificate hostname check bypassed when the host loosely resolves to an IP address.
- Lines affected
- 26, 24, 22
CVE-2026-111497
- What it is
- Out-of-bounds write in the Brotli decoder that permits remote code execution.
- Lines affected
- 26, 24, 22
The other six are rated medium or low. The fixed versions are 26.12.1, 24.22.1 and 22.23.4. They also update Node's built-in certificate list for the eMudhra certificate incident. nodejs.org notes that end-of-life versions are affected by security releases too and should be upgraded.
Check your version, and where Node came from
node -v
which -a node| Path contains | Installed by |
|---|---|
/opt/homebrew/ | Homebrew |
.nvm | nvm |
.volta | Volta |
fnm | fnm |
mise | mise |
.asdf | asdf |
/usr/local/bin/node | Usually the installer from nodejs.org (on an Intel Mac, it can also be Homebrew) |
/opt/homebrew/- Installed by
- Homebrew
.nvm- Installed by
- nvm
.volta- Installed by
- Volta
fnm- Installed by
- fnm
mise- Installed by
- mise
.asdf- Installed by
- asdf
/usr/local/bin/node- Installed by
- Usually the installer from nodejs.org (on an Intel Mac, it can also be Homebrew)
The first line of which -a node is the one Terminal runs. The others still run when a project or tool picks them, so update each one you use.
Update Node with the tool that installed it
The examples use 24.22.1. For the 26 line use 26.12.1, and for the 22 line use 22.23.4.
Homebrew
brew update
brew upgrade nodeFor a versioned formula, name it: brew upgrade node@22. If node -v still shows the old version afterwards, Homebrew may not have published the new build yet. Run brew update and try again later.
nvm
nvm install 24.22.1 --reinstall-packages-from=current
nvm alias default 24.22.1--reinstall-packages-from=current copies your global npm packages from the version you're on. nvm alias default makes new Terminal windows use the new version.
Volta
volta install node@24.22.1For a project that pins Node in package.json, run volta pin node@24.22.1 in its folder.
fnm
fnm install 24.22.1
fnm default 24.22.1mise or asdf
mise use -g node@24.22.1asdf install nodejs 24.22.1
asdf set -u nodejs 24.22.1
# asdf older than 0.16
asdf global nodejs 24.22.1The installer from nodejs.org
- Download the macOS Installer (.pkg) for 26.12.1, 24.22.1 or 22.23.4 from nodejs.org.
- Open the downloaded .pkg and follow the installer. It replaces the version in
/usr/local/bin. - Open a new Terminal window and run
node -vto confirm the version.
After updating
- Restart running Node processes. Dev servers, watchers and anything started before the update keep the old version until they restart.
- Update project pins.
.nvmrc,.node-version,.tool-versionsand thevoltafield inpackage.jsonchoose a version per project, so change them to the fixed version. - Check every version you keep.
nvm ls,fnm list,volta list node,mise ls nodeandbrew list --versions | grep -E "^node"list what's installed.
Package Watch in iKnowMyMac
Package Watch in iKnowMyMac checks the Python packages in every environment on your Mac, including certifi, against published advisories.