Node.js shipped security releases on Wednesday, October 21, 2026, patching 10 vulnerabilities across its three supported lines, four of them rated high. The most serious is CVE-2026-111497, an out-of-bounds write in Node’s Brotli decoder that can lead to remote code execution. Fixes landed in Node.js 22.23.4, 24.22.1, and 26.12.1, according to the official Node.js security release page. If you’re running an older build on any of those lines, or you decompress Brotli data from anywhere outside your own control, this is worth updating for today rather than next sprint.
The Brotli Bug Is the One to Act On First
CVE-2026-111497 affects Node’s built-in Brotli decoder, the code path used whenever something decompresses br-encoded content, whether that’s an HTTP response pulled in through fetch or undici, a reverse proxy passing compressed payloads through to your app, or a file your service unpacks on upload. An out-of-bounds write during decompression means a crafted payload can corrupt memory the process wasn’t expecting to touch, and in the worst case that opens the door to running attacker-supplied code on the server. Any service that decompresses Brotli content it didn’t generate itself should treat this as the priority fix in the batch.
Three More High-Severity Bugs, All About Hostname Validation
The other three high-severity issues aren’t related to Brotli at all. They’re all variations on the same theme: a crafted hostname or IP-like string tricking Node’s TLS stack into matching a certificate it shouldn’t.
- CVE-2026-105483: TLS certificate hostname validation can be bypassed when the IP address in the certificate is written using fullwidth digit characters instead of standard ASCII digits.
- CVE-2026-106069: A similar bypass occurs when the connecting host loosely resolves to an IP address, letting Node match a certificate for a target it didn’t actually intend to trust.
- CVE-2026-105482:
dns.resolve()silently truncates hostnames that contain a NUL character, which can cause a lookup, and anything downstream relying on it, to resolve the wrong name.
None of these need a public-facing exploit chain to matter. Anywhere Node is doing its own hostname-to-certificate matching, service mesh clients, outbound API calls pinned to a specific host, mTLS between internal services, these three bugs undercut the assumption that the matching is strict.
The Rest: Medium and Low Severity, Still Worth Knowing About
Three medium-severity fixes round out the TLS and runtime picture. CVE-2026-106072 is another certificate validation gap, this time for non-canonical IPv4 hostnames that let a DNS-based Subject Alternative Name authenticate an IP endpoint it shouldn’t. CVE-2026-105481 covers a keep-alive socket that can process a response written before the matching request was even sent, a timing issue that gets stranger the more concurrent traffic a service handles. And CVE-2026-106074 is one worth flagging for anyone using Node’s startup snapshot feature or Single Executable Applications: the entropy caches behind crypto.randomUUID() and randomInt() get baked into the snapshot, so every process started from that snapshot repeats the same “random” values instead of generating fresh ones.
The three low-severity fixes mostly concern Node’s Permission Model: a wildcard radix lookup that over-grants filesystem access, a bypass via fs.realpathSync, and a ZIP-handling bug where a failed header check still leaks attacker-controlled prefix bytes back to the caller. Lower urgency, but they land in the same release, so they come along for the ride when you update.
What to Do
Update to 22.23.4, 24.22.1, or 26.12.1 depending on which line you’re on, and don’t stop at the host runtime. Docker base images, Lambda layers, and any CI pipeline that caches a Node binary need rebuilding too, or you’ll ship the old vulnerable version right back out. If you’re maintaining anything on an older major line that isn’t covered by this release, that’s a separate conversation worth having, since it means you’re not getting fixes for this batch or the next one either.
If your team runs production Node services and nobody’s entirely sure which patch versions are actually pinned across environments right now, that gap is common, and it’s exactly the kind of thing we check during backend reviews as part of our web application development work. It’s also worth a look if your Node services sit behind queues or webhook consumers, where a stale or crashing process causes its own kind of damage independent of any CVE.
