Node.js 26.12.1 Patches 10 CVEs, Next.js 15 EOL, PG 19

Executive Summary

• Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 CVEs, four rated High, including a Brotli decoder flaw (CVE-2026-111497) and two TLS hostname-check bugs. See the official advisory.
• Next.js shipped an out-of-band security update on Oct 14 for two Critical and one High upstream vulnerabilities, and maintenance support for Next.js 15 ended Oct 21. Details in the announcement.
• PostgreSQL 19 RC1 is available, and PgBouncer 1.26.1 fixes three CVEs including an authentication bypass (CVE-2026-107350). See the PostgreSQL news archive.
• Docker Engine 29.9.x is the current line per third-party trackers, and Engine 25 reaches end of life on 2026-12-04. Check the Docker Engine lifecycle table.

Node.js: 10 CVEs across three release lines

The October 2026 security release patches the 26.x, 24.x and 22.x lines. The four High-severity issues are:

• CVE-2026-111497: zlib, the bundled Brotli decoder (26.x, 24.x, 22.x).
• CVE-2026-105482: dns.resolve*() and dns.reverse() (26.x, 24.x, 22.x).
• CVE-2026-105483 and CVE-2026-106069: tls.checkServerIdentity() (the first affects 26.x and 24.x, the second all three lines).

The three Medium issues cover http Agent keep-alive socket reuse, TLS hostname verification and crypto randomness helpers (randomUUID, randomUUIDv7, randomInt). The three Low issues touch zlib.ZipFile and the Permission Model. The release also bumps c-ares, OpenSSL, SQLite and Undici and removes a compromised eMudhra intermediate CA. End-of-life lines are always affected, so Node 25, 23, 21 and 20 users must move to a supported line.

Verify and upgrade:

node --version   # want v26.12.1, v24.22.1 or v22.23.4
nvm install 24 --latest-npm
# Containers: pin the patched tag
# FROM node:24.22.1-slim

Next.js: security update and Next.js 15 end of life

The Next.js team announced an out-of-band update for Oct 14 covering two Critical and one High vulnerability in upstream dependencies; two fixes slipped from the September release because of upstream coordination. Trackers list 16.4.x as current, and Next.js 15 maintenance ended Oct 21. If you are still on 15, plan the move to 16 now:

npm install next@latest react@latest react-dom@latest
npx next build

PostgreSQL 19 RC1 and PgBouncer 1.26.1

PostgreSQL 19 RC1 is out for testing, and ecosystem tools such as pg_hint_plan 1.9.0 already declare compatibility. PgBouncer 1.26.1 (Oct 14) fixes three CVEs, including the authentication bypass CVE-2026-107350, and psqlODBC 18.00.0005 fixes CVE-2026-109448; both are listed in the PostgreSQL news archive. The next minor release is due Nov 12, 2026, which is also the final release for PostgreSQL 14.

Docker Engine

Third-party trackers show Engine 29.9.0 (Oct 8) followed by 29.9.1 (Oct 14), with Engine 25 ending on 2026-12-04. Docker's own changelog was not reachable in this audit, so confirm the exact version against the lifecycle table and the Docker release notes before upgrading.

Action items

1. Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 and rebuild images.
2. Move Next.js 15 apps to 16.x.
3. Patch PgBouncer to 1.26.1 and schedule PostgreSQL 14 upgrades before Nov 12.