Node.js shipped security releases on Wednesday, October 21, 2026, patching 10 vulnerabilities across its three supported lines, four of them rated high. The most serious is CVE-2026-111497, an out-of-bounds write in Node’s Brotli decoder that can lead to remote code execution. Fixes landed in Node.js 22.23.4, 24.22.1, and 26.12.1, according to the official Node.js security release page. If you’re running an older build on any of those lines, or you decompress Brotli data from anywhere outside your own control, this is worth updating for today rather than next sprint.
The Brotli Bug Is the One to Act On First
CVE-2026-111497 affects Node’s built-in Brotli decoder, the code path used whenever something decompresses br-encoded content, whether that’s an HTTP response pulled in through fetch or undici, a reverse proxy passing compressed payloads through to your app, or a file your service unpacks on upload. An out-of-bounds write during decompression means a crafted payload can corrupt memory the process wasn’t expecting to touch, and in the worst case that opens the door to running attacker-supplied code on the server. Any service that decompresses Brotli content it didn’t generate itself should treat this as the priority fix in the batch.
Three More High-Severity Bugs, All About Hostname Validation
The other three high-severity issues aren’t related to Brotli at all. They’re all variations on the same theme: a crafted hostname or IP-like string tricking Node’s TLS stack into matching a certificate it shouldn’t.
- CVE-2026-105483: TLS certificate hostname validation can be bypassed when the IP address in the certificate is written using fullwidth digit characters instead of standard ASCII digits.
- CVE-2026-106069: A similar bypass occurs when the connecting host loosely resolves to an IP address, letting Node match a certificate for a target it didn’t actually intend to trust.
- CVE-2026-105482:
dns.resolve()silently truncates hostnames that contain a NUL character, which can cause a lookup, and anything downstream relying on it, to resolve the wrong name.
None of these need a public-facing exploit chain to matter. Anywhere Node is doing its own hostname-to-certificate matching, service mesh clients, outbound API calls pinned to a specific host, mTLS between internal services, these three bugs undercut the assumption that the matching is strict.
The Rest: Medium and Low Severity, Still Worth Knowing About
Three medium-severity fixes round out the TLS and runtime picture. CVE-2026-106072 is another certificate validation gap, this time for non-canonical IPv4 hostnames that let a DNS-based Subject Alternative Name authenticate an IP endpoint it shouldn’t. CVE-2026-105481 covers a keep-alive socket that can process a response written before the matching request was even sent, a timing issue that gets stranger the more concurrent traffic a service handles. And CVE-2026-106074 is one worth flagging for anyone using Node’s startup snapshot feature or Single Executable Applications: the entropy caches behind crypto.randomUUID() and randomInt() get baked into the snapshot, so every process started from that snapshot repeats the same “random” values instead of generating fresh ones.
The three low-severity fixes mostly concern Node’s Permission Model: a wildcard radix lookup that over-grants filesystem access, a bypass via fs.realpathSync, and a ZIP-handling bug where a failed header check still leaks attacker-controlled prefix bytes back to the caller. Lower urgency, but they land in the same release, so they come along for the ride when you update.
What to Do
Update to 22.23.4, 24.22.1, or 26.12.1 depending on which line you’re on, and don’t stop at the host runtime. Docker base images, Lambda layers, and any CI pipeline that caches a Node binary need rebuilding too, or you’ll ship the old vulnerable version right back out. If you’re maintaining anything on an older major line that isn’t covered by this release, that’s a separate conversation worth having, since it means you’re not getting fixes for this batch or the next one either.
If your team runs production Node services and nobody’s entirely sure which patch versions are actually pinned across environments right now, that gap is common, and it’s exactly the kind of thing we check during backend reviews as part of our web application development work. It’s also worth a look if your Node services sit behind queues or webhook consumers, where a stale or crashing process causes its own kind of damage independent of any CVE.
Update – October 28, 2026
This turned out to be bigger than a Node.js problem. Microsoft shipped an out-of-band security update for .NET on October 25, fixing the same CVE-2026-111497 Brotli decoder flaw across its supported .NET releases, separate from the regular monthly patch cycle. Any .NET app that calls into Brotli decompression, whether for request decompression or automatic response decompression, carried the same out-of-bounds write.
Security firm Wiz published research the same day showing the vulnerable Brotli code isn’t confined to Node.js or .NET at all. It ships inside Bun (versions 1.0.21 through 1.4.3, fixed in 1.4.4), Envoy Proxy, Istio, Go’s andybalholm/brotli library, and Python’s Brotli and brotlicffi packages on PyPI, both patched in versions 1.2.1 and 1.2.1.0 under advisory GHSA-9v8h-qqgm-4m35. Wiz found vulnerable copies sitting in 91 percent of the cloud environments it scanned, since Brotli decompression gets bundled into networking and web-serving infrastructure rather than something teams install deliberately.
No confirmed in-the-wild attacks yet, but Imperva researcher Ron Masas has already demonstrated a working exploit against unpatched Node.js, according to Wiz. If your stack touches .NET, Bun, Go, or Python anywhere near something that decompresses untrusted Brotli data, it’s worth checking regardless of whether you already patched Node.
Update – November 3, 2026
CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, listing it as the “Google Brotli Unchecked Return Value Vulnerability” and giving US federal civilian agencies until November 10 to patch under Binding Operational Directive 26-04. CISA didn’t publish exploitation details, but adding a flaw to that catalog is itself a statement that it has evidence of active exploitation.
Two threat intelligence firms logged real attack attempts in the days before that listing. ELLIO recorded a malicious request against a Node.js 24.22.0 honeypot on October 26, though the exploit chain it captured was broken and never produced a working shell in its own testing. Previdian logged a separate attempt the next day from a US-based IP. Neither firm confirmed a successful compromise, but ELLIO found that most of its captured attempts against Express crashed the worker process outright, so a failed exploit attempt can still knock a service offline even without achieving code execution.
The BOD 26-04 deadline only binds US federal agencies, but CISA is telling every defender to prioritize this one. If you’re still running an older build on any of the three supported Node.js lines, or you haven’t rebuilt the Docker images and CI caches that keep handing out the old binary, this is the push to stop deferring it.
Sources
- Node.js, Wednesday, October 21, 2026 Security Releases (official Node.js security release page)
- Microsoft .NET 10.0 out-of-band security update, October 25, 2026
- Wiz, “Broccoli2Shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability,” October 25, 2026
- GitHub Security Advisory GHSA-9v8h-qqgm-4m35 (Brotli PyPI package)
- CISA Known Exploited Vulnerabilities Catalog, entry added October 27, 2026
- SecurityWeek, “CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts,” October 28, 2026
