Node.js patches 10 security flaws including a Brotli bug that can allow remote code execution

The Node.js project shipped security releases for its 22, 24 and 26 lines on October 21, 2026. According to Node.js's security advisory, the update fixes 10 vulnerabilities: four high, three medium and three low severity. The fixed versions are 22.23.4, 24.22.1 and 26.12.1.

The most serious flaw: the Brotli decoder

Brotli is a compression format widely used on the web; browsers and servers can compress pages with it. Node.js bundles its own decoder to decompress Brotli data. According to the advisory, CVE-2026-111497 is an out-of-bounds write in this decoder that can allow remote code execution. It affects all three release lines. The release notes show the fix is a cherry-pick of a fix from the Brotli project's own code.

Node.js has not shared details on how the flaw is triggered or a severity score (CVSS). Applications that decompress Brotli data from outside sources that an attacker could craft are at risk, for example servers that inflate request bodies sent with Content-Encoding: br, or programs that decompress responses from servers you do not control.

Two TLS validation flaws

Two other high-severity issues concern how Node.js validates the certificate of the server it connects to. In CVE-2026-105483, the hostname check could be bypassed when an IP address was written in fullwidth digits; in CVE-2026-106069, when the host loosely resolved to an IP address. Flaws like these can help someone in the middle pose as the server being contacted. The fourth high-severity issue is CVE-2026-105482: dns.resolve truncated names at a NUL character.

Other fixes

• Medium: a keep-alive socket processing a response written before the request was sent (CVE-2026-105481); improper certificate validation for non-canonical IPv4 hostnames (CVE-2026-106072); entropy caches for crypto.randomUUID() and randomInt() being saved into startup snapshots, so every process repeats the same "random" values (CVE-2026-106074).
• Low: three issues in the ZIP reader and the permission model (CVE-2026-106070, CVE-2026-106071, CVE-2026-106073).
• Dependency updates: c-ares, OpenSSL (3.5.9), SQLite and undici. The trusted root certificate list was also updated to NSS 3.131.1, which removes trust in certificates from eMudhra, the India-based certificate authority whose private keys were compromised.

What to do

Check the version on servers and development machines with node -v and move to 22.23.4, 24.22.1 or 26.12.1 depending on your line. If you use Docker, rebuild your images on the new Node.js base; containers running old images stay exposed. If you install Node.js from your Linux distribution's package manager, follow your distribution's security advisories. Node.js 20 and older are end of life and will not get this fix; Node.js reminds users that end-of-life versions should be considered affected by every security release.

The details currently rest only on Node.js's advisory and release notes; the project has not shared technical details or severity scores. Until it is clear in which usage patterns the Brotli flaw can be triggered from outside, updating applications that accept compressed data from external sources first is the safest course. Follow independent security researchers' assessments for other perspectives on the story.