Node.js October Patches for Expo and React Native Backends
The Node.js security releases of October 21, 2026, read for people whose app has a backend, a build pipeline or a CI job. Checked October 24, 2026.
Founder, Newly
Published Last updated
The app on the phone does not run a Node.js server. The machines around it often do, including your API server, build machine, CI runner and containers. Node.js published fixes on October 21, 2026. Run node --version in each place Node.js runs, move to 22.23.4, 24.22.1 or 26.12.1 or later in your line, then rebuild and restart.
What did Node.js release on October 21, 2026?
| Fact | What the Node.js notice says |
|---|---|
| Date | Wednesday, October 21, 2026, checked October 24, 2026 |
| Size | Ten CVEs: four high, three medium, three low. The notice covers a Brotli decoder flaw that can lead to remote code execution (CVE-2026-111497), three TLS address checks, a DNS name truncation, and smaller issues |
| Affected lines | 22.x, 24.x and 26.x. End-of-life versions are always affected when a security release occurs |
| Fixed in | 22.23.4 / 24.22.1 / 26.12.1 |
| Workaround | None listed. The fix is the update |
| Exploitation | Not reported in the notice. Unknown, not ruled out |
This page is a companion for app builders. The wider list of that week's incidents is in the October 2026 tracker on red.run.cloud and in our version of it for app builders.
Where does Node.js run in an Expo or React Native project?
Newly builds a real React Native and Expo app for iPhone and Android, and you can download the code or connect your own repository. The installed app is one piece. The rest of what you run is yours to list, and each line below has a different owner.
| Place | Does Node.js update apply? | What to read |
|---|---|---|
| Your own API server (Express or similar) | Yes. Expo's API routes guide lists Express and Node.js as one way to host server routes | node --version on the running host, plus the last restart time |
| Vercel functions | Yes. Vercel offers 24.x (default) and 22.x and says it rolls out patch updates when needed. The setting applies to new deployments | Redeploy, then log process.version |
| EAS Hosting | Unknown. Expo says it is built on Cloudflare Workers with V8 isolates and partial Node.js support. The page does not say who patches it | The provider's written answer |
| Supabase Edge Functions | Not directly. Supabase describes a Deno compatible runtime | Supabase status and changelog |
| CI runners | Yes. actions/setup-node checks its local cache first, so a version range such as 24.x can be served by an older patch | A node --version step in the job log |
| Docker images | Yes, at rebuild. OWASP recommends pinning the base image by digest, so a pinned digest stays old until you change it | The FROM line and the build date |
One more reason to keep secrets on the server
Expo documents that anything in an EXPO_PUBLIC_ variable is visible in plain text in your compiled app. Keys that must stay private belong in server code, which is the code these Node.js fixes apply to. The 15-minute check of an AI-built app covers that list.
Which Node.js versions fix these issues?
| Line | Fixed release | Scheduled end of life |
|---|---|---|
| Node.js 26 | 26.12.1 | April 30, 2029 |
| Node.js 24 | 24.22.1 | April 30, 2028 |
| Node.js 22 | 22.23.4 | April 30, 2027 |
| Node.js 20 and older | No fix. Move to a supported line | Node.js 20 ended April 30, 2026 |
Dates come from the Node.js release schedule, which says dates are subject to change. The project's end-of-life page states that an end-of-life release receives no security patches. Moving from an old line to a current one can break code, so test the upgrade on a copy first.
Which of the ten fixes could matter to my app?
Each issue has a condition. Read the right-hand column against your own server code. If you cannot tell, the answer for that row is unknown and the update is the way to close it.
| CVE and severity | Condition in the notice | Look for this in your code |
|---|---|---|
| CVE-2026-111497, high | Brotli data that an application decompresses with node:zlib can corrupt process memory, leading to a crash, memory disclosure or remote code execution | brotli in your server code or its dependencies, and zlib calls on data from outside |
| CVE-2026-105482, high | Hostnames with a NUL byte are truncated by dns.resolve*(), so code can act on a different name than it validated | A check on a hostname followed by a DNS lookup |
| CVE-2026-105483 and CVE-2026-106069, high; CVE-2026-106072, medium | A TLS certificate can be accepted for a different IP address when the address is written in an unusual way | Features that connect to an address a user supplies, such as a webhook URL or an import from a link |
| CVE-2026-105481, medium | A client can accept a response sent before its request on a reused keep-alive connection | Server code that calls other services over HTTP |
| CVE-2026-106074, medium | Random value caches are saved into startup snapshots and single executable apps | --build-snapshot or a packaged single executable |
| CVE-2026-106070, 106071, 106073, low | ZIP header caching (26.x only), and two permission model checks | Reading ZIP files, or running with --permission |
The Brotli row is the one to take seriously because it is listed as remote code execution. A server that never decompresses Brotli data has a narrower exposure, but a dependency can do it without your code saying so, which is why a code search alone leaves the item unknown.
How do I check and update my own project?
1. List every place Node.js runs (5 minutes)
Use the table above as the template: the API server, any serverless project, CI workflows, Dockerfiles, and the laptop that builds releases. Write the host name beside each.
2. Read the real version (2 minutes each)
Run node --version on the running host, or log process.version at startup. Vercel documents process.version or node -v in the build command for this. A version read on your laptop says nothing about the server.
3. Update, rebuild, restart
Move each line to its fixed release, rebuild images, and redeploy. A running process keeps the Node.js it started with, so an update on disk does not count until the restart.
4. Keep npm audit in its lane
npm audit reports on the dependencies in your package tree, not on the runtime. Run it as well, and keep the two results separate. For how to keep later updates deliberate, see the dependency pinning checklist.
5. Look at the site in front of the app
A free scan on red.run.cloud reads the technologies a live site serves, but a Node.js version is often not visible from outside, so expect unknown. The same-day PHP fix is covered in our PHP2Shell page for app builders.
Where do you stand?
Everything starts as unknown. Move an item to confirmed only when you hold the evidence listed under it. A scan from outside cannot move an item for you.
Your Node.js check
- Detected: You found the problem.
- Unknown: Not checked yet, or the check could not tell.
- Confirmed by owner evidence: You checked and kept the proof.
Your answers stay in this browser tab. Nothing is saved or sent.
Frequently asked questions
Does my React Native app on the phone need a Node.js update?
No. The installed app does not run a Node.js server. The update matters for machines and services that run Node.js for you: your API server, your build machine, your CI runner and any container image built on a Node.js base image.
I only use Expo API routes on EAS Hosting. Am I covered?
It is unknown until the host says so. Expo documents that EAS Hosting runs on Cloudflare Workers, which uses V8 isolates and offers partial Node.js support, so these releases do not map onto it one to one. The Expo page does not say who patches that runtime. Ask the provider, or keep the answer as unknown.
Do I need to rotate my API keys because of these releases?
The Node.js notice lists no workaround and does not ask for key rotation. The fix is to update and redeploy. Rotation is a separate step if a platform that holds your keys was breached, and our rotation guide covers that case.
Does npm audit tell me whether my Node.js is patched?
No. npm documents that audit checks the dependencies in your project's package tree against an advisory database. The Node.js runtime itself is not in that tree, so read node --version instead.
My host says it uses Node 24. Is that enough?
Only the full version tells you. Node.js 24 before 24.22.1 is affected. Ask for the exact version of the running deployment, and for the time of the last redeploy, because a long-running process keeps the Node.js build it started with.
Were these flaws exploited?
The Node.js notice, checked on 24 October 2026, does not report exploitation. That absence does not prove none happened. We could not search the CISA Known Exploited Vulnerabilities catalog for CVE-2026-111497 from the page we fetched, so treat exploitation status as unknown and update anyway.
Sources
Each source was opened on October 24, 2026. The CISA catalog could not be searched from the page we fetched.
- Node.js Security Release, October 21, 2026, nodejs.org
- Node.js 22.23.4 (LTS) release notes, nodejs.org
- Node.js 24.22.1 (LTS) release notes, nodejs.org
- Node.js 26.12.1 release notes, nodejs.org
- Node.js release schedule, GitHub, nodejs/release
- Node.js end-of-life versions, nodejs.org
- zlib: Brotli decompression, Node.js API docs
- Environment variables in Expo, Expo docs
- Expo Router API routes, Expo docs
- EAS Hosting introduction, Expo docs
- Supported Node.js versions, Vercel docs
- Supabase Edge Functions, Supabase docs
- actions/setup-node, GitHub
- npm audit, npm docs
- Node.js Docker cheat sheet, OWASP Cheat Sheet Series
- Known Exploited Vulnerabilities catalog, CISA