Node.js Security Fixes, Astro 7.4.2 and Drizzle 1.0 RC5

Executive Summary

• Node.js 26.12.1, 24.22.1 and 22.23.4 (Oct 21) fix ten CVEs, four rated High, including a Brotli decoder out-of-bounds write that permits remote code execution (CVE-2026-111497). See the official advisory.
• Astro 7.4.2 (Oct 21) raises its minimum Node.js to 22.23.4 and fixes several dev-server problems. See the Astro releases.
• Drizzle ORM 1.0.0-rc.5 (Oct 21) ships a long list of breaking changes: strict undefined filters, primary-first replicas and new relational query caching. See the release page.
• BullMQ 6.4.0 (Oct 21) adds reliable realtime messaging. See the BullMQ releases.
• Prisma 8.0.0-rc.24 (Oct 21) continues the 8.0 release-candidate train with contract and schema syntax changes. See the Prisma releases.
• Still unpatched in many stacks: Next.js 15.5.28 / 16.4.1 critical RCE fixes from Oct 14 (official post). Next.js is now at 16.4.2.

Also on the registry in the last 24 hours: Clerk Next.js SDK 7.9.19, Motion 14.5.0, Elysia 2.0.0-rc.0 and React canary builds. No release notes were reviewed for these, so check them before upgrading.

Node.js Security Releases: Brotli RCE and TLS Hostname Bypasses

The October 2026 security releases landed on Oct 21 for the 26.x, 24.x and 22.x lines. The High-severity fixes are:

• CVE-2026-111497: out-of-bounds write in the Brotli decoder that permits remote code execution (26.x, 24.x, 22.x).
• CVE-2026-105482: dns.resolve truncates names containing a NUL character (26.x, 24.x, 22.x).
• CVE-2026-105483: TLS certificate hostname bypass when an IP is written with fullwidth digits (26.x, 24.x).
• CVE-2026-106069: TLS certificate hostname bypass when a host loosely resolves to an IP address (26.x, 24.x, 22.x).

Medium fixes include CVE-2026-106074, where crypto.randomUUID() and randomInt() entropy caches were saved into startup snapshots and single executable applications, so every process repeated the same values. Three Low-severity issues touch the ZIP reader and the Permission Model. The release also updates c-ares, OpenSSL (24.x, 22.x), SQLite (22.x) and Undici, and addresses the eMudhra intermediate CA compromise.

End-of-life lines are always affected by security releases, so move to a supported version. For containers, rebuild on a fresh base image:

# Dockerfile
FROM node:22.23.4-slim
# or node:24.22.1-slim / node:26.12.1-slim

# rebuild without cache so the patched base is pulled
docker build --pull --no-cache -t app:patched .
node -v   # expect v22.23.4, v24.22.1 or v26.12.1

Astro 7.4.2: Node 22.23.4 Floor and Dev Server Fixes

Astro 7.4.2 is a patch release, but one change affects your toolchain: the minimum supported Node.js version is now 22.23.4 (#18475), which pulls in the October security fixes. Other changes:

• Content sync with experimental.collectionStorage: "chunked" is much faster; the chunking step on a ~44k-entry store drops from about 60 seconds to under one (#18430).
• astro dev with @astrojs/cloudflare no longer fails with a require error for node-fetch (#18438).
• A stale lock file with a Linux thread ID is no longer treated as a running server, which could make astro dev stop or --force kill an unrelated process (#18376).
• astro sync, astro check and astro build no longer replace a running dev server's optimized dependencies (#18451).
• defineConfig() types for i18n.defaultLocale, i18n.fallback and i18n.domains now accept a locale's path (#18467).

If you pin Node in CI, update it alongside Astro:

{
  "engines": { "node": ">=22.23.4" }
}

Drizzle ORM 1.0.0-rc.5: Breaking Changes Before 1.0

1.0.0-rc.5 is a release candidate, so pin it deliberately. The notes list many breaking changes (the page was truncated, so read the full notes before upgrading):

• Relational query where now throws on undefined. Use the new EmptyFilter export to mark an optional filter explicitly.
• An empty relation filter such as posts: {} is skipped instead of checking existence. Use true or false to filter by presence.
• withReplicas sends queries to the primary by default. Use db.$replica to read from a replica.
• DrizzleQueryError omits params unless you pass paramsInErrors: true.
• Relational queries are cached by caches using the all strategy. Opt out with withCache: false.
• The relational query builder (RQBv2) has a new build strategy that can break raw SQL referencing relation aliases. Opt out per query with strategy: 'basic'.
• postgres-js: transparent parsers no longer conflict with the driver's serializers for timestamp, date, time and JSON. Remove manual JSON.stringify workarounds.

// before: silently ignored undefined
db.query.users.findMany({ where: { id: maybeId } });

// rc.5: throws on undefined
db.query.users.findMany({ where: { id: maybeId ?? EmptyFilter } });

// read from a replica explicitly
const rows = await db.$replica.select().from(users);

The snippet illustrates the documented behavior; confirm exact import paths and signatures against the release notes.

BullMQ 6.4.0: Reliable Realtime Messaging

BullMQ 6.4.0 adds support for reliable realtime messaging (#4904). The release page lists no other fixes. Read the linked issue for the API before adopting it in production.

Prisma 8.0 Release Candidates

Prisma 8.0.0-rc.24 was published on Oct 21 to npm. The release page reviewed for this audit covered rc.11 through rc.19, so details for rc.20 to rc.24 are not summarized here. Across that train, the notable direction is:

• @default now means a database default; generated values move to @onCreate(...) and @onUpdate(...).
• Every schema file needs // use prisma-8 as its first line, and prisma.config.ts must import definePrismaConfig.
• dbgenerated(...) is removed in favor of sql literals, and --confirm no longer consents to data loss (use --delete or --rename).
• A model without @@map uses its name as written; run the add-model-map script first.

Next.js Reminder: Patch the Oct 14 Critical RCEs

The Next.js out-of-band update fixes two unauthenticated RCEs and one DoS: GHSA-673q-mjm6-r5xr (use cache functions returning typed arrays, no known workaround), CVE-2026-96889 (SVG in the Image Optimization API on glibc Linux; workaround is sharp 0.35.5 or later) and GHSA-p3m5-59mp-jv5r (Server Actions DoS).

npm install [email protected]  # for 15.5
npm install [email protected]   # for 16.4 (latest on npm is 16.4.2)

Action Items

• Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 and rebuild container images with --pull.
• Confirm Next.js is on 15.5.28 or 16.4.1+.
• Hold Drizzle 1.0 RC and Prisma 8 RC upgrades to a branch until you have read the breaking-change lists.
• Bump CI Node versions before upgrading Astro to 7.4.2.

Coverage note: GitHub release APIs were not reachable in this run, so versions and dates come from the npm registry and the linked official pages. Docker, Cloudflare, Kubernetes, database engines and auth platforms had no verified changes today.