[{"data":1,"prerenderedAt":1182},["ShallowReactive",2],{"content-/nodejs-october-2026-security-release-check":3,"all-pages-for-dir":1160,"related-/nodejs-october-2026-security-release-check":1161,"og-image-/nodejs-october-2026-security-release-check":1181},{"id":4,"title":5,"body":6,"category":1145,"concepts":1145,"description":1146,"extension":1147,"meta":1148,"navigation":320,"ogImage":1145,"path":1149,"project_name":1145,"published":1150,"publishedAt":1151,"seo":1152,"source":1145,"stem":1153,"tags":1154,"todo":1145,"unpublished":1150,"updatedAt":1145,"__hash__":1159},"pages/2026-10/2026-10-22/nodejs-october-2026-security-release-check.md","Node.js 2026年10月のセキュリティリリース：自分の環境が対象か調べて更新する手順",{"type":7,"value":8,"toc":1127},"minimark",[9,18,72,75,79,82,239,242,256,260,271,276,400,410,414,433,578,582,589,597,604,646,668,678,681,684,720,723,729,731,753,830,843,847,907,924,934,937,944,955,959,977,1030,1033,1036,1051,1061,1064,1067,1093,1096,1123],[10,11,12,13,17],"p",{},"2026-10-21、Node.js が 26.x・24.x・22.x の3系統にセキュリティリリースを出した。深刻度 High が4件含まれる。",[14,15,16],"strong",{},"手元やサーバーで Node.js を動かしているなら、使っている系統の修正版へ上げる。"," 回避策は公表されておらず、更新が唯一の対処になる。",[19,20,21,37],"table",{},[22,23,24],"thead",{},[25,26,27,31,34],"tr",{},[28,29,30],"th",{},"系統",[28,32,33],{},"修正版",[28,35,36],{},"最高深刻度",[38,39,40,52,62],"tbody",{},[25,41,42,46,49],{},[43,44,45],"td",{},"26.x",[43,47,48],{},"v26.12.1",[43,50,51],{},"High",[25,53,54,57,60],{},[43,55,56],{},"24.x",[43,58,59],{},"v24.22.1",[43,61,51],{},[25,63,64,67,70],{},[43,65,66],{},"22.x",[43,68,69],{},"v22.23.4",[43,71,51],{},[10,73,74],{},"サポートが終わった系統（20.x 以前など）は、公式の方針として「常に影響を受けるもの」とされる。修正版は出ないので、サポート中の系統へ移る。",[76,77,78],"h2",{"id":78},"何が直ったか",[10,80,81],{},"公式の告知に載っている一覧は次のとおり（2026-10-22 時点）。",[19,83,84,100],{},[22,85,86],{},[25,87,88,91,94,97],{},[28,89,90],{},"CVE",[28,92,93],{},"深刻度",[28,95,96],{},"内容",[28,98,99],{},"対象系統",[38,101,102,115,127,140,156,169,181,197,214,227],{},[25,103,104,107,109,112],{},[43,105,106],{},"CVE-2026-111497",[43,108,51],{},[43,110,111],{},"Brotli 伸長処理の範囲外書き込み（リモートコード実行につながりうる）",[43,113,114],{},"26 / 24 / 22",[25,116,117,120,122,125],{},[43,118,119],{},"CVE-2026-106069",[43,121,51],{},[43,123,124],{},"ホスト名が IP アドレスに緩く解釈されると TLS 証明書のホスト名検証をすり抜ける",[43,126,114],{},[25,128,129,132,134,137],{},[43,130,131],{},"CVE-2026-105483",[43,133,51],{},[43,135,136],{},"全角数字で書いた IP アドレスで TLS 証明書のホスト名検証をすり抜ける",[43,138,139],{},"26 / 24",[25,141,142,145,147,154],{},[43,143,144],{},"CVE-2026-105482",[43,146,51],{},[43,148,149,153],{},[150,151,152],"code",{},"dns.resolve"," が NUL 文字を含む名前を途中で切る",[43,155,114],{},[25,157,158,161,164,167],{},[43,159,160],{},"CVE-2026-105481",[43,162,163],{},"Medium",[43,165,166],{},"keep-alive のソケットが、リクエスト送信前に書かれた応答を処理してしまう",[43,168,114],{},[25,170,171,174,176,179],{},[43,172,173],{},"CVE-2026-106072",[43,175,163],{},[43,177,178],{},"正規形でない IPv4 表記のホスト名で、DNS 名の SAN が IP 接続先を認証してしまう",[43,180,114],{},[25,182,183,186,188,195],{},[43,184,185],{},"CVE-2026-106074",[43,187,163],{},[43,189,190,191,194],{},"スタートアップスナップショットや単一実行ファイル（SEA）で ",[150,192,193],{},"crypto.randomUUID()"," などの乱数キャッシュが保存され、毎回同じ値になる",[43,196,114],{},[25,198,199,202,205,212],{},[43,200,201],{},"CVE-2026-106073",[43,203,204],{},"Low",[43,206,207,208,211],{},"Permission Model を ",[150,209,210],{},"fs.realpathSync"," で迂回できる",[43,213,114],{},[25,215,216,219,221,224],{},[43,217,218],{},"CVE-2026-106070",[43,220,204],{},[43,222,223],{},"ZIP ヘッダ検証に失敗したあと、攻撃者が制御するバイト列を返す",[43,225,226],{},"26 のみ",[25,228,229,232,234,237],{},[43,230,231],{},"CVE-2026-106071",[43,233,204],{},[43,235,236],{},"Permission Model のワイルドカード指定でファイルシステム権限を過剰に与える",[43,238,226],{},[10,240,241],{},"同梱ライブラリも更新されている。c-ares・undici・ルート証明書（eMudhra の中間 CA 侵害への対応を含む）は全系統、OpenSSL は 24.x と 22.x、SQLite は 22.x で上がった。",[10,243,244,247,248,251,252,255],{},[14,245,246],{},"発動条件の詳細は、2026-10-22 時点で公開されていない。"," 告知とリリースノートには CVE の題名とコミットの題名しかなく、GitHub のセキュリティアドバイザリにもまだ載っていない。たとえば Brotli の件が「どの API を通ったときに起きるか」は書かれていない。ただ、Node.js 標準の ",[150,249,250],{},"fetch"," は ",[150,253,254],{},"Content-Encoding: br"," の応答を自動で展開するので、外部のサーバーへ fetch しにいくスクリプトも無関係とは言い切れない。「サーバーを公開していないから関係ない」とは判断しないほうがよい。",[76,257,259],{"id":258},"手元の-node-が対象か調べる","手元の Node が対象か調べる",[10,261,262,263,266,267,270],{},"調べるのは「いま ",[150,264,265],{},"node"," と打って動くもの」だけでは足りない。",[14,268,269],{},"バージョン管理ツールの中に複数の版が入っていたり、定期ジョブが特定の版を直接指していたりする","からだ。次の順に見る。",[272,273,275],"h3",{"id":274},"_1-いま動く-node-と入っている全部の版","1. いま動く node と、入っている全部の版",[277,278,283],"pre",{"className":279,"code":280,"language":281,"meta":282,"style":282},"language-bash shiki shiki-themes vitesse-light vitesse-light","which -a node     # PATH 上の node をすべて\nnode -v\n\n# mise を使っている場合\nmise ls node\n\n# Homebrew を使っている場合（macOS）。node と node@22 などの版付き formula をすべて出す\nbrew list --versions | grep '^node'\n\n# nvm を使っている場合\nnvm ls\n","bash","",[150,284,285,306,315,322,328,340,345,351,380,385,391],{"__ignoreMap":282},[286,287,290,294,298,302],"span",{"class":288,"line":289},"line",1,[286,291,293],{"class":292},"sz8Xr","which",[286,295,297],{"class":296},"snbK4"," -a",[286,299,301],{"class":300},"sdGka"," node",[286,303,305],{"class":304},"sxvE3","     # PATH 上の node をすべて\n",[286,307,309,312],{"class":288,"line":308},2,[286,310,265],{"class":311},"senZ8",[286,313,314],{"class":296}," -v\n",[286,316,318],{"class":288,"line":317},3,[286,319,321],{"emptyLinePlaceholder":320},true,"\n",[286,323,325],{"class":288,"line":324},4,[286,326,327],{"class":304},"# mise を使っている場合\n",[286,329,331,334,337],{"class":288,"line":330},5,[286,332,333],{"class":311},"mise",[286,335,336],{"class":300}," ls",[286,338,339],{"class":300}," node\n",[286,341,343],{"class":288,"line":342},6,[286,344,321],{"emptyLinePlaceholder":320},[286,346,348],{"class":288,"line":347},7,[286,349,350],{"class":304},"# Homebrew を使っている場合（macOS）。node と node@22 などの版付き formula をすべて出す\n",[286,352,354,357,360,363,367,370,374,377],{"class":288,"line":353},8,[286,355,356],{"class":311},"brew",[286,358,359],{"class":300}," list",[286,361,362],{"class":296}," --versions",[286,364,366],{"class":365},"stQ0i"," |",[286,368,369],{"class":311}," grep",[286,371,373],{"class":372},"sMJiu"," '",[286,375,376],{"class":300},"^node",[286,378,379],{"class":372},"'\n",[286,381,383],{"class":288,"line":382},9,[286,384,321],{"emptyLinePlaceholder":320},[286,386,388],{"class":288,"line":387},10,[286,389,390],{"class":304},"# nvm を使っている場合\n",[286,392,394,397],{"class":288,"line":393},11,[286,395,396],{"class":311},"nvm",[286,398,399],{"class":300}," ls\n",[10,401,402,404,405,404,407,409],{},[150,403,69],{}," / ",[150,406,59],{},[150,408,48],{}," より古いものが1つでもあれば対象。",[272,411,413],{"id":412},"_2-プロジェクトごとの版の固定","2. プロジェクトごとの版の固定",[10,415,416,419,420,419,423,419,426,429,430],{},[150,417,418],{},".tool-versions","・",[150,421,422],{},"mise.toml",[150,424,425],{},".nvmrc",[150,427,428],{},".node-version"," で版を固定しているリポジトリは、",[14,431,432],{},"グローバルの既定を上げても、そのディレクトリでは古い版が動き続ける。",[277,434,436],{"className":279,"code":435,"language":281,"meta":282,"style":282},"# リポジトリ群をまとめて調べる例\nfor d in ~/git_repo/*/; do\n  for f in .tool-versions mise.toml .nvmrc .node-version; do\n    [ -f \"$d$f\" ] && echo \"$(basename \"$d\") $f: $(tr -d '\\r\\n' \u003C \"$d$f\")\"\n  done\ndone\n",[150,437,438,443,466,492,568,573],{"__ignoreMap":282},[286,439,440],{"class":288,"line":289},[286,441,442],{"class":304},"# リポジトリ群をまとめて調べる例\n",[286,444,445,449,453,456,459,463],{"class":288,"line":308},[286,446,448],{"class":447},"sHkkW","for",[286,450,452],{"class":451},"s4oTP"," d",[286,454,455],{"class":447}," in",[286,457,458],{"class":300}," ~/git_repo/*/",[286,460,462],{"class":461},"shFtX",";",[286,464,465],{"class":447}," do\n",[286,467,468,471,474,476,479,482,485,488,490],{"class":288,"line":317},[286,469,470],{"class":447},"  for",[286,472,473],{"class":451}," f",[286,475,455],{"class":447},[286,477,478],{"class":300}," .tool-versions",[286,480,481],{"class":300}," mise.toml",[286,483,484],{"class":300}," .nvmrc",[286,486,487],{"class":300}," .node-version",[286,489,462],{"class":461},[286,491,465],{"class":447},[286,493,494,497,500,503,506,509,512,515,518,520,523,526,528,531,533,536,539,541,543,546,548,551,554,557,559,561,563,565],{"class":288,"line":324},[286,495,496],{"class":461},"    [",[286,498,499],{"class":365}," -f",[286,501,502],{"class":372}," \"",[286,504,505],{"class":300},"$d$f",[286,507,508],{"class":372},"\"",[286,510,511],{"class":461}," ]",[286,513,514],{"class":461}," &&",[286,516,517],{"class":292}," echo",[286,519,502],{"class":372},[286,521,522],{"class":461},"$(",[286,524,525],{"class":311},"basename",[286,527,502],{"class":372},[286,529,530],{"class":300},"$d",[286,532,508],{"class":372},[286,534,535],{"class":461},")",[286,537,538],{"class":300}," $f: ",[286,540,522],{"class":461},[286,542,25],{"class":311},[286,544,545],{"class":296}," -d",[286,547,373],{"class":372},[286,549,550],{"class":300},"\\r\\n",[286,552,553],{"class":372},"'",[286,555,556],{"class":365}," \u003C",[286,558,502],{"class":372},[286,560,505],{"class":300},[286,562,508],{"class":372},[286,564,535],{"class":461},[286,566,567],{"class":372},"\"\n",[286,569,570],{"class":288,"line":330},[286,571,572],{"class":447},"  done\n",[286,574,575],{"class":288,"line":342},[286,576,577],{"class":447},"done\n",[272,579,581],{"id":580},"_3-定期ジョブが-node-をどう呼んでいるか","3. 定期ジョブが node をどう呼んでいるか",[10,583,584,585,588],{},"ここが一番見落としやすい。タスクスケジューラ（Windows）、launchd（macOS）、cron のジョブが、",[14,586,587],{},"バージョン付きの絶対パスで node を直接呼んでいる","ことがある。",[277,590,595],{"className":591,"code":593,"language":594,"meta":282},[592],"language-text","# 例: バッチファイルの中身\n\"C:\\Users\\\u003Cuser>\\AppData\\Local\\mise\\installs\\node\\22.22.2\\node.exe\" update.mjs\n","text",[150,596,593],{"__ignoreMap":282},[10,598,599,600,603],{},"このジョブは、mise で新しい版を入れても 22.22.2 のまま動き続ける。さらに後で古い版を消すと、",[14,601,602],{},"ジョブが黙って起動しなくなる","。",[277,605,607],{"className":279,"code":606,"language":281,"meta":282,"style":282},"# macOS: launchd のジョブで node を使っているもの\ngrep -l node ~/Library/LaunchAgents/*.plist\ncrontab -l | grep node\n",[150,608,609,614,633],{"__ignoreMap":282},[286,610,611],{"class":288,"line":289},[286,612,613],{"class":304},"# macOS: launchd のジョブで node を使っているもの\n",[286,615,616,619,622,624,627,630],{"class":288,"line":308},[286,617,618],{"class":311},"grep",[286,620,621],{"class":296}," -l",[286,623,301],{"class":300},[286,625,626],{"class":300}," ~/Library/LaunchAgents/",[286,628,629],{"class":296},"*",[286,631,632],{"class":300},".plist\n",[286,634,635,638,640,642,644],{"class":288,"line":317},[286,636,637],{"class":311},"crontab",[286,639,621],{"class":296},[286,641,366],{"class":365},[286,643,369],{"class":311},[286,645,339],{"class":300},[277,647,651],{"className":648,"code":649,"language":650,"meta":282,"style":282},"language-powershell shiki shiki-themes vitesse-light vitesse-light","# Windows: 有効なタスクの実行コマンドを一覧\nGet-ScheduledTask | Where-Object State -ne 'Disabled' |\n  ForEach-Object { $_.TaskName + ' => ' + (($_.Actions | ForEach-Object { $_.Execute + ' ' + $_.Arguments }) -join ' | ') }\n","powershell",[150,652,653,658,663],{"__ignoreMap":282},[286,654,655],{"class":288,"line":289},[286,656,657],{},"# Windows: 有効なタスクの実行コマンドを一覧\n",[286,659,660],{"class":288,"line":308},[286,661,662],{},"Get-ScheduledTask | Where-Object State -ne 'Disabled' |\n",[286,664,665],{"class":288,"line":317},[286,666,667],{},"  ForEach-Object { $_.TaskName + ' => ' + (($_.Actions | ForEach-Object { $_.Execute + ' ' + $_.Arguments }) -join ' | ') }\n",[10,669,670,673,674,677],{},[150,671,672],{},".cmd"," や ",[150,675,676],{},".sh"," を呼んでいるジョブは、そのファイルの中身まで開いて node のパスを確かめる。",[76,679,680],{"id":680},"対象外のもの",[10,682,683],{},"同じ「Node.js っぽいもの」でも、今回の修正と関係しないものがある。",[685,686,687,698,704,714],"ul",{},[688,689,690,693,694,697],"li",{},[14,691,692],{},"Cloudflare Workers",": ",[150,695,696],{},"nodejs_compat"," フラグは Node.js の API を互換実装で提供するもので、Node.js 本体は動いていない。実行環境（workerd）は Cloudflare が更新する",[688,699,700,703],{},[14,701,702],{},"静的サイト（SSG）の配信",": ビルドに Node.js を使っても、本番で配信しているのは HTML と JS のファイルだけ。本番側で Node.js は動かない。ビルドする手元の Node は更新対象",[688,705,706,709,710,713],{},[14,707,708],{},"単体の実行ファイルとして配られている CLI",": たとえば Claude Code のネイティブ版は単体の実行ファイルで、システムに入っている Node.js を使わない。こうしたツールの更新は配布元に任せる。逆に、",[150,711,712],{},"npx"," で起動する MCP サーバーなどはシステムの Node.js で動くので対象",[688,715,716,719],{},[14,717,718],{},"他社製品に同梱された Node.js",": GPU ドライバ付属のツールなど、製品の中に Node.js を抱えているものがある。自分では差し替えられないので、その製品のアップデートを当てる",[76,721,722],{"id":722},"更新する",[10,724,725,728],{},[14,726,727],{},"順番が大事。"," 新しい版を入れる → 古い版を指している場所を書き換える → 動作を確かめる → 最後に古い版を消す。古い版を先に消すと、絶対パスで呼んでいたジョブが止まる。",[272,730,333],{"id":333},[10,732,733,734,737,738,741,742,748,749,752],{},"まず ",[150,735,736],{},"mise ls node"," で、グローバルの既定がどの系統かを見る（設定ファイルの欄に ",[150,739,740],{},"~/.config/mise/config.toml"," が出ている行が既定）。",[14,743,744,747],{},[150,745,746],{},"mise use -g"," には、いま既定にしている系統の修正版を渡す。"," 24 系を既定にしている環境で ",[150,750,751],{},"node@22.23.4"," を渡すと、既定が 22 系に下がる。",[277,754,756],{"className":279,"code":755,"language":281,"meta":282,"style":282},"# 既定が 22 系なら\nmise install node@22.23.4\nmise use -g node@22.23.4\n\n# 既定が 24 系なら\nmise install node@24.22.1\nmise use -g node@24.22.1\n\n# 既定ではないが別の系統も入っているなら、install だけする\nmise install node@24.22.1\n",[150,757,758,763,773,785,789,794,803,813,817,822],{"__ignoreMap":282},[286,759,760],{"class":288,"line":289},[286,761,762],{"class":304},"# 既定が 22 系なら\n",[286,764,765,767,770],{"class":288,"line":308},[286,766,333],{"class":311},[286,768,769],{"class":300}," install",[286,771,772],{"class":300}," node@22.23.4\n",[286,774,775,777,780,783],{"class":288,"line":317},[286,776,333],{"class":311},[286,778,779],{"class":300}," use",[286,781,782],{"class":296}," -g",[286,784,772],{"class":300},[286,786,787],{"class":288,"line":324},[286,788,321],{"emptyLinePlaceholder":320},[286,790,791],{"class":288,"line":330},[286,792,793],{"class":304},"# 既定が 24 系なら\n",[286,795,796,798,800],{"class":288,"line":342},[286,797,333],{"class":311},[286,799,769],{"class":300},[286,801,802],{"class":300}," node@24.22.1\n",[286,804,805,807,809,811],{"class":288,"line":347},[286,806,333],{"class":311},[286,808,779],{"class":300},[286,810,782],{"class":296},[286,812,802],{"class":300},[286,814,815],{"class":288,"line":353},[286,816,321],{"emptyLinePlaceholder":320},[286,818,819],{"class":288,"line":382},[286,820,821],{"class":304},"# 既定ではないが別の系統も入っているなら、install だけする\n",[286,823,824,826,828],{"class":288,"line":387},[286,825,333],{"class":311},[286,827,769],{"class":300},[286,829,802],{"class":300},[10,831,832,834,835,838,839,842],{},[150,833,418],{}," で ",[150,836,837],{},"nodejs 24.12.0"," のように固定しているリポジトリは、そのファイルを ",[150,840,841],{},"24.22.1"," に書き換える。",[272,844,846],{"id":845},"homebrewmacos","Homebrew（macOS）",[277,848,850],{"className":279,"code":849,"language":281,"meta":282,"style":282},"brew update\nbrew list --versions | grep '^node'   # 入っている formula を確認\nbrew info node        # stable が 26.12.1 になっているか確認\nbrew upgrade node\nnode -v\n",[150,851,852,859,880,892,901],{"__ignoreMap":282},[286,853,854,856],{"class":288,"line":289},[286,855,356],{"class":311},[286,857,858],{"class":300}," update\n",[286,860,861,863,865,867,869,871,873,875,877],{"class":288,"line":308},[286,862,356],{"class":311},[286,864,359],{"class":300},[286,866,362],{"class":296},[286,868,366],{"class":365},[286,870,369],{"class":311},[286,872,373],{"class":372},[286,874,376],{"class":300},[286,876,553],{"class":372},[286,878,879],{"class":304},"   # 入っている formula を確認\n",[286,881,882,884,887,889],{"class":288,"line":317},[286,883,356],{"class":311},[286,885,886],{"class":300}," info",[286,888,301],{"class":300},[286,890,891],{"class":304},"        # stable が 26.12.1 になっているか確認\n",[286,893,894,896,899],{"class":288,"line":324},[286,895,356],{"class":311},[286,897,898],{"class":300}," upgrade",[286,900,339],{"class":300},[286,902,903,905],{"class":288,"line":330},[286,904,265],{"class":311},[286,906,314],{"class":296},[10,908,909,419,912,915,916,919,920,923],{},[150,910,911],{},"node@22",[150,913,914],{},"node@24"," のような版付きの formula を入れている場合、",[150,917,918],{},"brew upgrade node"," はそれを更新しない。入っているものごとに ",[150,921,922],{},"brew upgrade node@22"," のように名前を指定する。",[10,925,926,929,930,933],{},[14,927,928],{},"Homebrew の formula は公式リリースから数時間〜数日遅れて更新されることがある。"," ",[150,931,932],{},"brew info node"," がまだ古い版を示すなら、formula が追いつくのを待つか、nodejs.org のインストーラや mise を使う。",[272,935,936],{"id":936},"絶対パスで呼んでいるジョブ",[10,938,939,940,943],{},"バッチファイルや plist の中の ",[150,941,942],{},".../node/22.22.2/node.exe"," を新しい版のパスへ書き換え、一度手で実行してログを確かめる。",[10,945,946,947,950,951,954],{},"mise の shims のパスを呼ぶ形に変えれば、次回から書き換えずに済む。ただしその場合、開発の都合でグローバルの既定を戻したり上げたりすると、",[14,948,949],{},"ジョブも確認なしに同じ版へ切り替わる。"," 定期ジョブは版番号を書いたまま、起動時に ",[150,952,953],{},"node -v"," をログへ残しておくほうが安全だ。書き換え漏れは翌日のログで分かる。",[272,956,958],{"id":957},"cigithub-actions","CI（GitHub Actions）",[10,960,961,964,965,968,969,972,973,976],{},[150,962,963],{},"actions/setup-node"," に ",[150,966,967],{},"node-version: '22'"," のようにメジャー番号だけを書いていても、",[14,970,971],{},"GitHub のホスト型ランナーには版がプリインストールされており、既定ではそれが使われる。"," ランナーイメージの更新を待たずに修正版を使いたいなら ",[150,974,975],{},"check-latest: true"," を足す。",[277,978,982],{"className":979,"code":980,"language":981,"meta":282,"style":282},"language-yaml shiki shiki-themes vitesse-light vitesse-light","- uses: actions/setup-node@v4\n  with:\n    node-version: '22'\n    check-latest: true\n","yaml",[150,983,984,998,1006,1020],{"__ignoreMap":282},[286,985,986,989,992,995],{"class":288,"line":289},[286,987,988],{"class":461},"-",[286,990,991],{"class":292}," uses",[286,993,994],{"class":461},":",[286,996,997],{"class":300}," actions/setup-node@v4\n",[286,999,1000,1003],{"class":288,"line":308},[286,1001,1002],{"class":292},"  with",[286,1004,1005],{"class":461},":\n",[286,1007,1008,1011,1013,1015,1018],{"class":288,"line":317},[286,1009,1010],{"class":292},"    node-version",[286,1012,994],{"class":461},[286,1014,373],{"class":372},[286,1016,1017],{"class":300},"22",[286,1019,379],{"class":372},[286,1021,1022,1025,1027],{"class":288,"line":324},[286,1023,1024],{"class":292},"    check-latest",[286,1026,994],{"class":461},[286,1028,1029],{"class":447}," true\n",[272,1031,1032],{"id":1032},"古い版を消す",[10,1034,1035],{},"ジョブとリポジトリの固定を全部書き換え、動作を確かめてから消す。",[277,1037,1039],{"className":279,"code":1038,"language":281,"meta":282,"style":282},"mise uninstall node@22.22.2\n",[150,1040,1041],{"__ignoreMap":282},[286,1042,1043,1045,1048],{"class":288,"line":289},[286,1044,333],{"class":311},[286,1046,1047],{"class":300}," uninstall",[286,1049,1050],{"class":300}," node@22.22.2\n",[10,1052,1053,1056,1057,1060],{},[150,1054,1055],{},"mise prune"," でまとめて消す方法もあるが、mise が見ているのは自分の設定ファイルだけだ。",[14,1058,1059],{},"バッチファイルや plist が絶対パスで指している版は「使われていない」と判断されて消える。"," 書き換えが済む前には使わない。",[76,1062,1063],{"id":1063},"どこから手を付けるか",[10,1065,1066],{},"全部を一度に直せないときは、次の順に優先する。",[1068,1069,1070,1076,1082,1090],"ol",{},[688,1071,1072,1075],{},[14,1073,1074],{},"インターネットからの接続を受けるサーバー","（HTTP サーバー、Webhook の受け口）",[688,1077,1078,1081],{},[14,1079,1080],{},"外部のサーバーへ定期的にアクセスするジョブ","（スクレイピング、API の定期取得）。人が見ていない時間に動き、TLS や応答の展開処理を通る",[688,1083,1084],{},[14,1085,1086,1087,1089],{},"ふだんの開発で使う node と、",[150,1088,712],{}," で起動するツール",[688,1091,1092],{},"CI のランナー",[76,1094,1095],{"id":1095},"参考",[685,1097,1098,1109,1116],{},[688,1099,1100],{},[1101,1102,1108],"a",{"href":1103,"target":1104,"rel":1105},"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","_blank",[1106,1107],"noopener","noreferrer","Node.js 公式: October 2026 Security Releases",[688,1110,1111],{},[1101,1112,1115],{"href":1113,"target":1104,"rel":1114},"https://nodejs.org/en/blog/release/v22.23.4",[1106,1107],"Node.js v22.23.4 リリースノート",[688,1117,1118],{},[1101,1119,1122],{"href":1120,"target":1104,"rel":1121},"https://github.com/nodejs/node/security/advisories",[1106,1107],"Node.js GitHub セキュリティアドバイザリ",[1124,1125,1126],"style",{},"html pre.shiki code .sz8Xr, html code.shiki .sz8Xr{--shiki-default:#998418;--shiki-dark:#998418}html pre.shiki code .snbK4, html code.shiki .snbK4{--shiki-default:#A65E2B;--shiki-dark:#A65E2B}html pre.shiki code .sdGka, html code.shiki .sdGka{--shiki-default:#B56959;--shiki-dark:#B56959}html pre.shiki code .sxvE3, html code.shiki .sxvE3{--shiki-default:#A0ADA0;--shiki-dark:#A0ADA0}html pre.shiki code .senZ8, html code.shiki .senZ8{--shiki-default:#59873A;--shiki-dark:#59873A}html pre.shiki code .stQ0i, html code.shiki .stQ0i{--shiki-default:#AB5959;--shiki-dark:#AB5959}html pre.shiki code .sMJiu, html code.shiki .sMJiu{--shiki-default:#B5695977;--shiki-dark:#B5695977}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHkkW, html code.shiki .sHkkW{--shiki-default:#1E754F;--shiki-dark:#1E754F}html pre.shiki code .s4oTP, html code.shiki .s4oTP{--shiki-default:#B07D48;--shiki-dark:#B07D48}html pre.shiki code .shFtX, html code.shiki .shFtX{--shiki-default:#999999;--shiki-dark:#999999}",{"title":282,"searchDepth":308,"depth":308,"links":1128},[1129,1130,1135,1136,1143,1144],{"id":78,"depth":308,"text":78},{"id":258,"depth":308,"text":259,"children":1131},[1132,1133,1134],{"id":274,"depth":317,"text":275},{"id":412,"depth":317,"text":413},{"id":580,"depth":317,"text":581},{"id":680,"depth":308,"text":680},{"id":722,"depth":308,"text":722,"children":1137},[1138,1139,1140,1141,1142],{"id":333,"depth":317,"text":333},{"id":845,"depth":317,"text":846},{"id":936,"depth":317,"text":936},{"id":957,"depth":317,"text":958},{"id":1032,"depth":317,"text":1032},{"id":1063,"depth":308,"text":1063},{"id":1095,"depth":308,"text":1095},null,"2026-10-21 に Node.js の 26.x・24.x・22.x へ High を含むセキュリティ修正が出た。手元の Node が対象かを調べるコマンドと、バージョン管理ツール・定期ジョブ・CI ごとの更新手順、対象外のものをまとめる。","md",{},"/nodejs-october-2026-security-release-check",false,"2026-10-22T00:00:00.000Z",{"title":5,"description":1146},"2026-10/2026-10-22/nodejs-october-2026-security-release-check",[1155,1156,333,1157,1158],"Node.js","セキュリティ","Homebrew","脆弱性対応","3NHxvPAVV3V9oYSGzIN05BwM-OIi8Yu1vF80EmSa7ko",[],[1162,1166,1170,1174,1177],{"title":1163,"path":1164,"publishedAt":1165},"Volta から mise へ移行する方法（2026年版・メンテナンス終了対応）","/volta-to-mise-migration-guide","2026-06-09T00:00:00.000Z",{"title":1167,"path":1168,"publishedAt":1169},"Volta から mise への移行完了 - Claude Code を入れ直すまでに詰まった5つの落とし穴","/volta-to-mise-migration-complete","2026-04-23T00:00:00.000Z",{"title":1171,"path":1172,"publishedAt":1173},"2026年3月9日の開発日記 - Volta終了とmise移行の調査","/2026-03-09-diary","2026-03-09T00:00:00.000Z",{"title":1175,"path":1176,"publishedAt":1173},"Voltaがメンテナンス終了 - miseへの移行をどう進めるか","/volta-to-mise-migration",{"title":1178,"path":1179,"publishedAt":1180},"リポジトリ監査283件の修正計画に回答し、Codexの容量不足エラーは聞かずにやり直す運用にした日（戦術ボードのシーン分割とWorkersの確認つき）","/dd-283-fix-plan-decisions-and-scene-split","2026-10-21T00:00:00.000Z","https://log.eurekapu.com/og/blog/nodejs-october-2026-security-release-check.png?v=2026-10-22T00%3A00%3A00.000Z&title=Node.js%202026%E5%B9%B410%E6%9C%88%E3%81%AE%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3%E3%83%AA%E3%83%AA%E3%83%BC%E3%82%B9%EF%BC%9A%E8%87%AA%E5%88%86%E3%81%AE%E7%92%B0%E5%A2%83%E3%81%8C%E5%AF%BE%E8%B1%A1%E3%81%8B%E8%AA%BF%E3%81%B9%E3%81%A6%E6%9B%B4%E6%96%B0%E3%81%99%E3%82%8B%E6%89%8B%E9%A0%86&author=Kei%20Komatsu&sig=5f00005a7f2a4008",1792652613842]