Vulnerabilities in the ea-nodejs22 package (October 2026 Node.js security releases)

Situation

Multiple security vulnerabilities were disclosed in Node.js in the October 2026 Node.js security releases. The ea-nodejs22 package bundled with cPanel & WHM is affected. Node.js assigned the following CVEs:

• CVE-2026-105482 (high): dns.resolve truncates names containing a NUL character
• CVE-2026-106069 (high): TLS certificate hostname bypass when the host loosely resolves to an IP address
• CVE-2026-111497 (high): Brotli decoder out-of-bounds write permits remote code execution
• CVE-2026-105481 (medium): keep-alive socket processes a response that was written before the request was sent
• CVE-2026-106072 (medium): improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints
• CVE-2026-106074 (medium): crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values
• CVE-2026-106073 (low): Permission Model bypass with fs.realpathSync

See the Node.js security release announcement for details.

Affected product version

Impact

An attacker may be able to run malicious code remotely (RCE) on a Node.js application that processes Brotli-compressed data. An attacker may also be able to bypass TLS certificate hostname checks and impersonate a trusted server.

Call to action

cPanel released the updated ea-nodejs22 package (v22.23.4), which includes the upstream Node.js fixes, in EasyApache 4 release 25.92 on October 21, 2026. To update the package:

1. Log into the server via SSH as the root user.
2. Check whether the ea-nodejs22 package is installed. If the command returns no output, the package is not installed and no update is needed:

   # rpm -qa | grep ea-nodejs22

3. Update the package:

   Note: Updating the package rebuilds the Apache configuration and restarts httpd gracefully.

   # dnf update ea-nodejs22

For details, see the EasyApache 4 changelog.

How to confirm the patched version is installed

Check the installed version of the ea-nodejs22 package:

# rpm -qa | grep ea-nodejs22

Make sure the version is 22.23.4 or later, as listed in the Patched versions column above.