Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix, so they should be moved to a supported line.
The Brotli flaw is in code Node.js bundles, not in a user’s own program. Node.js runs that code whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when code calls fetch() on a response sent with Brotli compression.
An application is exposed where it decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server.
The Brotli Flaw
The flaw is an out-of-bounds write in the Brotli decoder, set off by malformed compressed input. The fix is an upstream patch from the Brotli project that Node.js copied in, and it makes the decoder catch invalid input and stop earlier rather than writing past the buffer.
Brotli is Google’s compression library, and Node.js ships its own copy. The same fix shipped in Brotli 1.2.1, 1.1.1, and 1.0.10 on October 21, so other software that bundles Brotli may need the same update. The change was first made in Brotli’s source in February 2026 and shipped as a security release only in October.
“Remote code execution” is the project’s description of what the flaw could allow, and the flaw is rated high rather than critical. How far that has been shown in practice is narrower.
A public proof-of-concept published on October 22 reached code execution only against a deliberately weakened test build. On a standard Node.js build, its author reported a crash and a limited read of process memory, not code execution, and said a working attack on a normal build was not achieved.
Patched Node.js rejects the malformed input the proof-of-concept uses, and no exploitation of the flaw in the wild has been reported as of October 22.
The Other Flaws
Three of the other fixes are also rated high. Two are TLS certificate checks an attacker could bypass by writing a server’s IP address in an unusual form, so a certificate matches a host it should not (CVE-2026-106069 and CVE-2026-105483). The third stops dns.resolve from cutting a hostname short at an embedded null byte (CVE-2026-105482).
Node.js rates CVE-2026-105483 high, though the commit that fixed it calls the bug low-severity and hard to exploit.
The rest are medium and low severity. One medium flaw makes crypto.randomUUID() and crypto.randomInt() hand back the same values in every process when an application is built as a startup snapshot or a single-executable application (CVE-2026-106074), which undermines anything that relies on those values being unpredictable.
The full set, and the lines each one affects:
| CVE | What it is | Severity | Affected lines |
|---|---|---|---|
| CVE-2026-111497 | Out-of-bounds write in the Brotli decoder; remote code execution, per the project | High | 22.x, 24.x, 26.x |
| CVE-2026-106069 | TLS hostname-check bypass when a host resolves to an IP address in non-canonical form | High | 22.x, 24.x, 26.x |
| CVE-2026-105483 | TLS hostname-check bypass when an IP is written in fullwidth digits | High | 24.x, 26.x |
| CVE-2026-105482 | dns.resolve truncates names that contain a null byte | High | 22.x, 24.x, 26.x |
| CVE-2026-105481 | Keep-alive socket can process a response written before the request was sent | Medium | 22.x, 24.x, 26.x |
| CVE-2026-106072 | Certificate validation for non-canonical IPv4 lets DNS names authenticate IP endpoints | Medium | 22.x, 24.x, 26.x |
| CVE-2026-106074 | randomUUID() and randomInt() caches reused in startup snapshots and single-executable apps | Medium | 22.x, 24.x, 26.x |
| CVE-2026-106070 | ZipFile returns attacker-controlled bytes after a failed header check | Low | 26.x |
| CVE-2026-106071 | Permission Model over-grants file access through a wildcard lookup | Low | 26.x |
| CVE-2026-106073 | Permission Model bypass with fs.realpathSync | Low | 22.x, 24.x, 26.x |
The eMudhra Certificate Block
The same updates also stop Node.js from trusting eight intermediate certificate authority keys from the Indian provider eMudhra that were reported compromised days earlier.
Node.js uses the Mozilla root certificate list but does not perform revocation checks by default, so before this update, a certificate chain built on one of the compromised keys still passed.
The releases add a built-in block on the eight keys and update the bundled root list to remove three emSign roots. Go made the same block in its own update on October 20.
Connections resumed from a session that began before the update are not re-checked until that session times out, and end-of-life lines do not get the block.
Updated Dependencies
Beyond the 10 flaws, the updates refresh several bundled parts. The copy of undici, the HTTP client behind fetch(), moves to a version that fixes three moderate advisories: one in its Subresource Integrity check and two memory-exhaustion flaws, one of them in the WebSocket client built into Node.js.
Node.js also updated its bundled c-ares on all lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x, to include fixes for publicly known vulnerabilities.
If You Cannot Upgrade Yet
Upgrading is the fix. The advisory offers no temporary workaround for the Brotli flaw, so an application that cannot upgrade immediately has no fallback within Node.js itself.
Vercel, which runs Node.js for its customers, said it added firewall rules on October 21 that block the attack in inbound requests. The rules do not cover Brotli responses an application fetches from other servers, and do not replace upgrading.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
