Node.js Ships c-ares DNS Resolver Fixes Across Three Release Lines
The Node.js Project published its Wednesday, October 21, 2026 Security Releases advisory on October 21, 2026, with dependency updates to c-ares on the 26.x, 24.x and 22.x release lines. The updates address public vulnerabilities in c-ares, the asynchronous DNS resolver library that Node.js bundles. c-ares handles hostname lookups in the background, so the runtime can keep serving other work while a lookup completes. According to the advisory, the highest severity issue fixed in the release is rated HIGH.
The post sits under the project's Security Releases and Vulnerabilities category on the Node.js blog. The advisory is the October entry in a series of security releases that the project has published throughout 2026. An earlier entry, dated July 29, 2026, disclosed that an incomplete fix for CVE-2026-48934 allowed HTTPS Agent TLS session reuse, the practice of resuming an encrypted connection without a full new handshake, to skip hostname verification. That disclosure concerns a separate defect.
On October 22, 2026, HKCERT published a security bulletin stating that multiple vulnerabilities had been identified in Node.js. HKCERT warned that a remote attacker could exploit some of them.
For operators, the practical question is which release line is in use. The advisory addresses 26.x, 24.x and 22.x separately, so a fleet running a different line will need to map its version to the corresponding fixed build before concluding it is covered. Because c-ares sits beneath application code, the remedy is a runtime upgrade rather than a change to each service. That makes the patch straightforward to roll out in principle, but it also means that the work falls on whoever owns the Node.js binary or container base image, which is often not the team that wrote the service.
The broader context here is the placement of the flaw. DNS resolution is a common path for attacker-influenced input, and a bundled library is easy to overlook in a software bill of materials (SBOM) that lists only top-level packages. Teams that track the Node.js runtime as a dependency in its own right will find the October advisory easier to act on than teams that track only their application packages.
In my view, the more useful reading of the two months of advisories is procedural. A predictable cadence of dated security releases, each with a version map and a severity rating, gives platform teams something they can schedule around. The July TLS issue and the October c-ares updates are separate matters, but both concern components that sit below the application, which is where a runtime's trust decisions are made.
The fixes are available in the released builds for each affected line. Anyone running Node.js in production has a clear next step: confirm the release line, read the advisory's version map, and schedule the upgrade.
