News Vulnerabilities & Zero-Days

Node.js patches 10 flaws, including a Brotli bug that permits remote code execution and TLS certificate bypasses

Node.js released 26.12.1, 24.22.1 and 22.23.4 on 21 October 2026 to fix 10 vulnerabilities, four rated high, including a Brotli decoder flaw that permits remote code execution and two TLS hostname verification bypasses. The update also blocks the compromised eMudhra certificates.

Published Updated
Illustration of a green Node.js hexagon logo on a server, with a cracked compressed data block leaking code and a broken TLS padlock beside it.

Key takeaways

  • Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 vulnerabilities, four rated high.
  • A Brotli decoder out-of-bounds write (CVE-2026-111497) permits remote code execution in all supported lines.
  • Two TLS hostname verification bypasses could let the wrong certificate be accepted.
  • The update also blocks the compromised eMudhra intermediate certificates.
  • End-of-life Node.js versions are affected and get no fixes.

The Node.js project released security updates on 21 October 2026 for all three supported release lines, fixing 10 vulnerabilities. Four are rated high, and the highest severity in every supported line is high.

Which versions fix the flaws? #

Release line Patched version
26.x (Current) 26.12.1
24.x (LTS) 24.22.1
22.x 22.23.4

Node.js says end-of-life versions are always affected when a security release happens, so anyone on an older line should move to a supported one.

What are the most serious flaws? #

  • Brotli remote code execution (CVE-2026-111497): Node.js describes an out-of-bounds write in its Brotli decoder that "permits remote code execution" in all supported lines. Apps that decompress Brotli data from untrusted sources are the obvious concern. Node.js has not published further detail on the conditions needed.
  • TLS hostname verification bypasses (CVE-2026-105483, CVE-2026-106069): under certain hostname formats, such as IP addresses written with fullwidth digits, Node.js could accept a certificate for the wrong host. Bypasses like this can undermine the protection TLS gives against impersonation.
  • DNS name truncation (CVE-2026-105482): dns.resolve cut off names containing a NUL character, which could make an application resolve a different name from the one it checked.

What are all 10 vulnerabilities? #

CVE Issue Severity Affected lines
CVE-2026-111497 Brotli decoder out-of-bounds write permits remote code execution High 26.x, 24.x, 22.x
CVE-2026-105483 TLS certificate hostname bypass when the IP is written with fullwidth digits High 26.x, 24.x
CVE-2026-106069 TLS certificate hostname bypass when the host loosely resolves to an IP address High 26.x, 24.x, 22.x
CVE-2026-105482 dns.resolve truncates names containing a NUL character High 26.x, 24.x, 22.x
CVE-2026-105481 Keep-alive socket processes a response written before the request was sent Medium 26.x, 24.x, 22.x
CVE-2026-106072 Non-canonical IPv4 hostnames let DNS names in certificates authenticate IP endpoints Medium 26.x, 24.x, 22.x
CVE-2026-106074 crypto.randomUUID() and randomInt() repeat values in startup snapshots and single executable apps Medium 26.x, 24.x, 22.x
CVE-2026-106070 ZipFile returns attacker-controlled bytes after failed ZIP header validation Low 26.x
CVE-2026-106071 Permission Model filesystem over-grant via wildcard lookup Low 26.x
CVE-2026-106073 Permission Model bypass with fs.realpathSync Low 26.x, 24.x, 22.x

What else is in the update? #

The release also updates bundled dependencies: c-ares and Undici in all lines, OpenSSL in 24.x and 22.x, and SQLite in 22.x. It updates Node.js's built-in certificate store to handle the eMudhra intermediate certificate authority compromise disclosed this week, in which eight eMudhra intermediate keys were found to be recoverable.

Node.js has not reported any exploitation of these flaws.

What should Node.js users do? #

  1. Upgrade to Node.js 26.12.1, 24.22.1 or 22.23.4, and confirm with node -v.
  2. Rebuild and redeploy container images, serverless functions and single executable applications that bundle Node.js.
  3. Prioritize services that decompress Brotli data from users or other external sources, or rely on TLS client connections to IP addresses.
  4. If you use startup snapshots or single executable applications, rebuild them after upgrading so random values are no longer repeated.
  5. Move off end-of-life Node.js versions, which do not receive these fixes.

Sources

  1. Node.js October 2026 security releases, Node.js
  2. Node.js security updates fix TLS, DNS and Brotli flaws, Cyber Security News

Questions this raises

Which Node.js versions are patched?
Node.js 26.12.1, 24.22.1 (LTS) and 22.23.4, released on 21 October 2026.
Is the Brotli flaw being exploited?
Node.js has not reported any exploitation. It rates the flaw high and says it permits remote code execution.
Why does the update mention eMudhra?
Node.js updated its bundled certificate store to handle the eMudhra intermediate CA compromise, in which eight intermediate keys were found to be recoverable.

VulnerabilitySecurity UpdatePatch ManagementOpen Source SecurityApplication SecurityRemote Code ExecutionNode.jseMudhra