node-october-2026-security
Act as a security auditor for this Node.js repository.
CONTEXT Node.js published the October 2026 Security Release (2026-10-21). The fix is in versions 22.23.4, 24.22.1, and 26.12.1. The most severe issue is CVE-2026-111497 (high): an out-of-bounds write in the Brotli decoder that allows RCE. Other highs: CVE-2026-105483 and CVE-2026-106069 (TLS hostname bypass) and CVE-2026-105482 (dns.resolve with NUL). The mediums are CVE-2026-105481, CVE-2026-106072, and CVE-2026-106074 (repeated randomUUID/randomInt entropy in snapshots and SEA). The release also updates c-ares, OpenSSL, Undici, SQLite, and the CA certs. Node 20 and earlier are EOL and do NOT receive the fix. References: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases and https://vercel.com/kb/bulletin/node-js-security-advisory
PHASE 1: INVENTORY (read-only)
- Find every Node version the repo declares: .nvmrc, .node-version, .tool-versions, volta in package.json, engines.node, Dockerfile*/docker-compose* (FROM node:..., distroless/alpine images), .github/workflows/* (setup-node, node-version, matrix), .gitlab-ci.yml, Jenkinsfile, azure-pipelines, .devcontainer/, vercel.json, netlify.toml, serverless.yml, template.yaml (SAM), app.yaml, Procfile, IaC (Terraform/CDK/Pulumi: runtime nodejsXX.x).
- Detect the package manager (npm/yarn/pnpm/bun) and, for a monorepo, the workspaces.
- List the security checks the repo already has: Dependabot/Renovate (config and open PRs), CodeQL/code scanning, npm audit / audit-ci in CI, Snyk, Trivy/Grype for images, OSV-Scanner, secret scanning, SECURITY.md. If there are open Dependabot or code scanning alerts, read them.