Vulnerabilities in the ea-nodejs22 package (October 2026 Node.js security releases)

Internal case: CPANEL-57887

Original ticket: #96098463

Situation

Multiple security vulnerabilities were disclosed in Node.js in the October 2026 Node.js security releases. The ea-nodejs22 package bundled with cPanel & WHM is affected. Node.js assigned the following CVEs:

• CVE-2026-105482 (high): dns.resolve truncates names containing a NUL character
• CVE-2026-105483 (high): TLS certificate hostname bypass when the IP is written with fullwidth digits
• CVE-2026-106069 (high): TLS certificate hostname bypass when the host loosely resolves to an IP address
• CVE-2026-111497 (high): Brotli decoder out-of-bounds write permits remote code execution
• CVE-2026-105481 (medium): keep-alive socket processes a response that was written before the request was sent
• CVE-2026-106072 (medium): improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints
• CVE-2026-106074 (medium): crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values
• CVE-2026-106070 (low): ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation
• CVE-2026-106071 (low): Permission Model filesystem over-grant via wildcard radix lookup
• CVE-2026-106073 (low): Permission Model bypass with fs.realpathSync

See the Node.js security release announcement for details.

Affected product version

Impact

An attacker may be able to run malicious code remotely (RCE) on a Node.js application that processes Brotli-compressed data. An attacker may also be able to bypass TLS certificate hostname checks and impersonate a trusted server.

Call to action

cPanel released the updated ea-nodejs22 package (v22.23.4), which includes the upstream Node.js fixes, in EasyApache 4 release 25.92 on October 21, 2026. To update the package:

1. Log into the server via SSH as the root user.

2. Check whether the ea-nodejs22 package is installed. If the command returns no output, the package is not installed and no update is needed:

   # rpm -qa | grep ea-nodejs22

3. Update the package:

   Note: Updating the package rebuilds the Apache configuration and restarts httpd gracefully.

   # dnf update ea-nodejs22

For details, see the EasyApache 4 changelog.

How to confirm the patched version is installed

Check the installed version of the ea-nodejs22 package:

# rpm -qa | grep ea-nodejs22

Make sure the version is 22.23.4 or later, as listed in the Patched versions column above.

Additional information

• The system nodejs package (/usr/bin/node), which the Passenger package installs as a dependency, is separate from ea-nodejs22 and is updated through the operating system repositories, not EasyApache. Vulnerability scanners may flag it even after ea-nodejs22 is updated. See Installing ea-ruby27-mod_passenger or ea-apache24-mod-passenger on cPanel & WHM with CloudLinux or AlmaLinux installs an older Node.js as a dependency.
• Node.js 20 and earlier are end-of-life upstream and do not receive security fixes. Remove them or upgrade any application that depends on them.