On Wednesday, 21 October 2026, the Node.js project published security releases for all of its supported versions. Node.js is one of the core pieces that runs your CRHQ server. On 22 October we upgraded every CRHQ server, and our own systems including crhq.ai, to Node.js 22.23.4, the patched release for the version we use. There is nothing you need to do.
What was fixed
The Node.js project rated the most serious issues for our version line as high. In plain words, the fixes for that line cover:
| Issue | Severity | Reference |
|---|---|---|
| Decompressing specially crafted Brotli data (a common web compression format) could write outside its memory and allow code to run | High | CVE-2026-111497 |
| A secure (TLS) connection could accept a certificate for the wrong address when the address is written in an unusual way | High | CVE-2026-106069 |
| A DNS lookup could cut a name short when it contained a hidden null character | High | CVE-2026-105482 |
| A certificate for a domain name could be accepted for an IP address written in a non-standard form | Medium | CVE-2026-106072 |
| A reused (keep-alive) connection could accept a response that was sent before its request | Medium | CVE-2026-105481 |
| Random IDs could repeat in programs started from a saved startup snapshot | Medium | CVE-2026-106074 |
| A gap in Node.js's optional permission model when resolving file paths | Low | CVE-2026-106073 |
The release also updates libraries that come bundled with Node.js: OpenSSL, c-ares (used for DNS lookups), SQLite, Undici (used for web requests), and the list of trusted certificate authorities, which now leaves out a compromised one.
When it happened
| Date | What happened |
|---|---|
| 21 October | Node.js publishes the security releases |
| 22 October | Node.js 22.23.4 installed on every CRHQ server and on crhq.ai |
| 22 and 23 October | Planned restarts move the running platform onto the patched version. Agent work that was running at the time picked up again on its own |
What this means for you
- Nothing to do. Your CRHQ server already runs the patched version.
- Your own projects. If your agents run your own apps with their own copy of Node.js, for example inside a Docker container, that copy is separate from the one CRHQ runs. Ask your agent to check its version and update it if needed.
- Elsewhere. On your own machines, the Node.js project advises using an up-to-date version: 22.23.4, 24.22.1 or 26.12.1, depending on your version line.
Sources: the Node.js October 2026 security releases and the Node.js 22.23.4 release notes.
Questions? Reply to the email or write to hello@crhq.ai.