[swarnava]

Pins Node.js to 22.23.4, the patched release from the October 21, 2026 Node.js security release.

Why

The Node.js version pinned here predates that release. It fixes 10 CVEs, 4 rated High (release notes: 22.23.4).

CVE	Issue	Severity	Affects
CVE-2026-111497	Out-of-bounds write in the Brotli decoder, possible remote code execution	High	22, 24, 26
CVE-2026-106069	TLS hostname check passes when the host normalizes to an IP address	High	22, 24, 26
CVE-2026-105483	TLS hostname check passes for an IP written in fullwidth digits	High	24, 26
CVE-2026-105482	dns.resolve truncates names containing a NUL character	High	22, 24, 26
CVE-2026-105481	Keep-alive socket processes a response written before the request was sent	Medium	22, 24, 26
CVE-2026-106072	DNS SANs can authenticate non-canonical IPv4 endpoints	Medium	22, 24, 26
CVE-2026-106074	crypto.randomUUID()/randomInt() entropy caches saved into snapshots and SEAs	Medium	22, 24, 26
CVE-2026-106073	Permission model bypass with fs.realpathSync	Low	22, 24, 26

Two Low CVEs (CVE-2026-106070, CVE-2026-106071) affect only Node 26, fixed in 26.12.1. The release also updates OpenSSL to 3.5.9, c-ares to 1.34.9, undici, and the root certificates (dropping the compromised eMudhra intermediates).

Approach

Replace the Node.js pin with the patched release, keeping the existing format. No Node 26 pins were found; if Node 26 is used, it should be 26.12.1 or later.

Changes

• .nvmrc: v22.22.3 → v22.23.4

Validation

• Confirmed 22.23.4 is published on nodejs.org.
• No local build or test run. CI on this PR is the check.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-vercel-geist-font	Ready	Preview, v0	Oct 22, 2026 5:30pm UTC