Security · Published
The Node.js project released security updates on 21 October 2026 for its three supported lines: v22.23.4, v24.22.1 and v26.12.1. The official release page says the builds would be available on or shortly after Wednesday, 21 October. The release covers ten vulnerabilities. Node.js rates four of them high, three medium and three low.
The most serious item is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js says permits remote code execution. Brotli is a compression format that Node.js exposes through its zlib module, so any server that decompresses untrusted Brotli input is in scope. The advisory lists the affected lines as 26.x, 24.x and 22.x, which means every branch that receives the update is exposed.
Three other high-severity entries concern name resolution and certificate checks. CVE-2026-105482 is a bug where dns.resolve truncates names that contain a NUL character. CVE-2026-105483 allows a TLS certificate hostname check to be bypassed when the IP address is written with fullwidth digits. CVE-2026-106069 allows a similar bypass when a host name loosely resolves to an IP address. Certificate hostname checks are what stop a client from accepting a certificate issued for a different server, so bypasses here matter for any code that makes outbound TLS connections.
The medium-severity items include CVE-2026-105481, in which a keep-alive socket can process a response that was written before the request was sent. CVE-2026-106072 covers improper certificate validation for non-canonical IPv4 host names. CVE-2026-106074 is a bug in which the entropy caches behind crypto.randomUUID() and randomInt() are saved into startup snapshots and single executable applications, so every process built from them repeats the same values. The low-severity entries cover a ZIP header validation flaw and two Permission Model issues, one involving wildcard lookups and one involving fs.realpathSync.
Node.js does not say in its release page whether any of these bugs are being exploited. A write-up from Security Online reports that the project does not report in-the-wild exploitation and that no public proof-of-concept has been confirmed. That write-up is a secondary source, so the honest reading is that the official page is silent on exploitation rather than confirming that none exists.
The practical step is to move to the patched release on your line. Node.js notes that end-of-life versions are always affected when a security release ships, so any server still running an unsupported branch should be moved to a supported one. According to the secondary write-up, the release also updates bundled dependencies, including c-ares, OpenSSL, SQLite and Undici, and refreshes the bundled CA certificate store to remove trust tied to the eMudhra intermediate certificate authority. Applications packaged as single executables or snapshots need to be rebuilt, because the entropy issue is baked into those artefacts. Running node -v on each host will show which version is installed.
Why it matters: Node.js powers many API servers, build tools and command-line utilities, and a Brotli memory-corruption bug on a public-facing service is the kind of flaw that attackers look for. The certificate bypasses matter for software that trusts TLS checks to authenticate peers. The entropy issue matters for anything that generates tokens or identifiers in packaged builds.
Several things are unknown. Neither the release page nor the secondary write-up gives a count of exposed servers. The release page does not say whether CVE-2026-111497 has a working exploit in circulation. It is also unclear how quickly Linux distributions and hosting providers will ship the builds, since some packaged copies lag the upstream release. Teams that cannot update immediately should check whether their Brotli decompression path receives untrusted input.
The primary source for this article is the Node.js security release page. Secondary coverage from Security Online was used for the bundled-dependency and certificate details.
Sources
This article was researched and written by an AI system from the sources listed above, under SavvyToolz's sourcing and freshness rules. Read the editorial policy.