Node.js Fixes 10 Security Flaws, Including Brotli Remote Code Execution

A Node.js security update released on October 21, 2026, fixes 10 vulnerabilities across the 22.x, 24.x and 26.x branches, including a high-severity Brotli decoder flaw that could allow remote code execution under affected conditions.

The Node.js project also addressed weaknesses in TLS certificate hostname verification, DNS processing, HTTP connections, cryptographic random-value handling and filesystem permission checks.

Developers and administrators should upgrade affected installations to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on their release branch.

The release is particularly relevant to internet-facing JavaScript services, API backends and containerized applications that process external data or establish encrypted connections to other systems.

However, the official advisory does not establish that attackers are already exploiting these vulnerabilities. The Brotli vulnerability’s remote-code-execution impact is confirmed in the advisory, while its detailed exploitation prerequisites have not been publicly specified there.

For broader vulnerability assessment and patch management guidance, see our Enterprise CVE and Vulnerability Security Hub.

Key Findings From the Node.js October 2026 Security Release

• Release date: October 21, 2026.
• Vulnerabilities fixed: 10 distinct Node.js CVEs.
• Severity breakdown: Four High, three Medium and three Low.
• Most concerning issue: CVE-2026-111497, a Brotli decoder out-of-bounds write with potential remote code execution.
• Other High issues: CVE-2026-105482, CVE-2026-105483 and CVE-2026-106069.
• Patched versions: 22.23.4, 24.22.1 and 26.12.1.
• Additional updates: Components including c-ares, root certificates, OpenSSL, SQLite and Undici, with branch-specific differences.

Node.js Security Update: Why Developers Should Prioritize It

Node.js powers JavaScript applications ranging from small backend services to enterprise APIs and large-scale cloud platforms.

Because the runtime processes network traffic, handles certificates, resolves hostnames and executes application code, vulnerabilities in its built-in components can affect applications even when their own source code has not changed.

The October security update addresses several different security boundaries.

Some findings concern how the runtime decides whether a TLS certificate matches a destination. Others involve malformed DNS input, HTTP connection state and the use of shared runtime data in generated applications.

The Brotli decoder issue deserves particular attention because memory corruption can have more serious consequences than an ordinary connection failure.

Yet organizations should not assume every Node.js service is equally exposed.

Exposure depends on runtime version, the affected API or feature, whether untrusted input can reach the vulnerable code and the application’s surrounding security controls.

Developers need both an accurate version inventory and a plan to deploy the appropriate fixed release.

This is not the first major Node.js security release in 2026. In June, the project addressed 12 separate vulnerabilities involving TLS authentication, denial-of-service risks and other runtime components. Read our earlier Node.js security vulnerabilities report covering 12 fixes to understand how the earlier issues differ from the October update.

CVE-2026-111497: Brotli Decoder Flaw Can Permit Remote Code Execution

CVE-2026-111497 is one of the most important vulnerabilities in the October release.

The Node.js security advisory identifies an out-of-bounds write in the Brotli decoder and states that the flaw permits remote code execution.

An out-of-bounds write occurs when software writes data beyond the memory region intended for a particular operation.

Memory-safety errors of this type can corrupt program state and, under certain conditions, may become exploitable beyond a simple application crash.

Brotli is a compression format commonly used to reduce the size of data transmitted or stored by applications.

Node.js provides interfaces that applications can use when working with compressed content.

Services that process untrusted Brotli-compressed data should therefore be prioritized for review.

However, the short Node.js advisory does not provide a complete public exploit chain, a reliable proof-of-concept procedure or a list of specific application frameworks confirmed exploitable through this issue.

It would be inaccurate to claim that every HTTP request to any vulnerable Node.js server can automatically achieve remote code execution.

Affected branches: Node.js 22.x, 24.x and 26.x.

Fixed releases: Node.js 22.23.4, 24.22.1 and 26.12.1.

CVE-2026-105482: DNS Names Truncated by NUL Characters

CVE-2026-105482 is a High-severity vulnerability involving Node.js DNS resolution.

According to the official advisory, the dns.resolve API can truncate names containing a NUL character.

A NUL character is commonly used as a string terminator in lower-level programming environments.

When different software components interpret a hostname differently, the name an application validates may not be the same name eventually used for a DNS lookup.

That inconsistency can create security problems in applications that rely on strict hostname validation.

For example, server-side applications may check supplied destinations before contacting them.

Validation and resolution should agree on what the destination string means.

The advisory identifies the problematic behavior but does not establish that every use of dns.resolve is exploitable or that a specific downstream service was compromised.

Affected branches: 22.x, 24.x and 26.x.

Two High-Severity TLS Hostname Verification Bypasses

The update also resolves two High-severity flaws related to validating TLS certificate identities.

CVE-2026-105483: Fullwidth IP Digits

CVE-2026-105483 concerns hostname verification when an IP address is represented using fullwidth digits.

These characters resemble ordinary numerical digits but have different Unicode representations.

Under the affected conditions, Node.js could incorrectly handle hostname matching during TLS certificate verification.

The issue affects Node.js 24.x and 26.x.

The project’s advisory does not list the 22.x branch as affected by this specific CVE.

CVE-2026-106069: Loosely Recognized IP Addresses

CVE-2026-106069 involves TLS hostname verification when a host is interpreted as an IP address through overly permissive recognition or normalization.

The security boundary matters because certificates for DNS names and certificates for IP addresses are subject to different identity-matching requirements.

Incorrect interpretation can result in a certificate being accepted for an unintended destination.

This vulnerability affects Node.js 22.x, 24.x and 26.x.

Neither advisory establishes that TLS encryption itself has been broken.

These are certificate identity-verification problems, not evidence that cryptographic algorithms were defeated.

Three Medium-Severity Node.js Vulnerabilities Explained

CVE-2026-105481: HTTP Keep-Alive Response Handling

This vulnerability involves a keep-alive socket processing a response that was written before its corresponding request was sent.

HTTP keep-alive connections allow clients to reuse an existing connection for subsequent requests.

Correct request-response ordering is necessary to avoid confusing application state and network operations.

Node.js patched the affected behavior across all three supported branches covered by this release.

The public advisory does not claim that this automatically causes remote code execution or a universal cross-user data leak.

CVE-2026-106072: Non-Canonical IPv4 Certificate Validation

CVE-2026-106072 is another certificate-verification weakness.

It allows a DNS Subject Alternative Name to authenticate an IP endpoint under affected conditions involving non-canonical IPv4 representations.

The issue is related to the distinction between DNS-name identity matching and IP-address identity matching.

Applications making HTTPS or other TLS connections should not rely on inconsistent hostname interpretation.

The affected branches are Node.js 22.x, 24.x and 26.x.

CVE-2026-106074: Repeated Random Values Across Snapshots

CVE-2026-106074 affects entropy caches used by crypto.randomUUID() and crypto.randomInt().

According to Node.js, the caches could be saved into user-land startup snapshots and single executable applications.

New processes created from those artifacts could repeat values that were expected to be independently generated.

This is particularly important when applications use generated values for identifiers or other security-sensitive purposes.

The extent of risk depends on how an application uses the generated values.

The advisory does not establish that all Node.js random-number generation is predictable or that every cryptographic operation is affected.

The issue affects all three release branches.

Three Low-Severity Flaws: ZIP Handling and Permission Model

CVE-2026-106070: Invalid ZIP Header Processing

This vulnerability affects the Node.js ZipFile implementation and can return attacker-controlled prefix bytes after ZIP header validation fails.

The issue is rated Low and affects Node.js 26.x.

It is not listed as affecting the 22.x or 24.x branches.

CVE-2026-106071: Filesystem Permission Over-Grant

CVE-2026-106071 concerns the Node.js Permission Model.

An error in wildcard radix lookup could grant filesystem access beyond the intended permission boundary.

The issue affects Node.js 26.x.

Applications depending on runtime filesystem restrictions should review whether the Permission Model is part of their security design.

CVE-2026-106073: fs.realpathSync Permission Bypass

This vulnerability involves filesystem permission enforcement through the fs.realpathSync API.

The affected behavior could bypass Permission Model checks under the conditions documented by Node.js.

It affects Node.js 22.x, 24.x and 26.x.

These Low-severity issues do not mean all filesystem permissions on a host are ineffective.

They concern specific runtime permission checks and features.

Node.js October 2026 Vulnerabilities: Complete CVE Table

The table summarizes the Node.js project’s October 21 advisory. Exact patch applicability should always be checked against the relevant release documentation.

Which Node.js Versions Fix the October 2026 Vulnerabilities?

The Node.js project published security releases for all three maintained branches covered by the advisory.

• Node.js 22.x LTS: Version 22.23.4.
• Node.js 24.x LTS: Version 24.22.1.
• Node.js 26.x Current: Version 26.12.1.

These releases include the relevant Node.js vulnerability fixes and other component updates for their respective branches.

The October update also includes work involving c-ares, trusted root certificates, Undici, OpenSSL and SQLite, with differences between branches.

Administrators should not assume that upgrading an unrelated npm dependency fixes a vulnerability in the Node.js runtime itself.

A runtime security release requires the actual Node.js executable used by the application to be updated.

Applications still using end-of-life branches should plan migration to a supported release.

How to Check Your Node.js Version

Developers can check the runtime version from a trusted terminal:

node --version

For example, a result showing an earlier build in an affected branch indicates that an update may be required.

The version reported by a local developer laptop does not necessarily match the version running in production.

Check servers, containers, CI runners, scheduled jobs and separately deployed application services.

Inspect the Node.js Runtime Used by an Application

To inspect the active executable and runtime versions:

node -p "process.execPath"
node -p "process.versions"

The second command provides information about the Node.js runtime and bundled component versions.

These checks are useful for inventory but do not independently demonstrate that every application dependency is free of vulnerabilities.

Check a Running Docker Image

For a running container, administrators can inspect its Node.js runtime:

docker exec <container_name> node --version

Replace the placeholder with the actual container identifier or name.

This confirms the version used inside that particular running container.

Containerized workloads should be rebuilt from updated, trusted base images and redeployed after testing.

How to Patch Node.js Applications Safely

Begin by inventorying all Node.js installations and mapping them to applications.

Identify the package manager or deployment method used for each workload.

Some environments use a Node.js version manager. Others rely on operating-system packages, Docker base images, CI provisioning or platform-managed runtimes.

The safe upgrade process depends on that environment.

For Applications Using nvm

Where the Node Version Manager is already installed and approved for the environment, administrators can install an exact patched release:

nvm install 24.22.1
nvm use 24.22.1
node --version

This example updates a Node.js 24 environment.

For the 22.x or 26.x branch, use the corresponding verified security release instead.

Changing the runtime locally does not automatically update system services or other deployment environments.

For Docker Deployments

Use a trusted image containing the required patched Node.js version.

Where an official image for the exact version is available and suitable for the application’s architecture, pin the image version rather than relying entirely on a floating tag.

For example:

FROM node:24.22.1

Rebuild the image, run application tests and deploy it through the normal release process.

For reproducible production builds, consider verifying and pinning approved image digests.

Be aware that Node.js release tags and underlying container-image availability are separate publishing processes.

For Kubernetes Deployments

Rebuild the affected workload’s image and update its Kubernetes Deployment, StatefulSet or other workload definition.

Use the organization’s existing rollout process and readiness checks.

Confirm that newly started pods are actually using the patched runtime.

A successful image build alone does not demonstrate that every old pod was replaced.

Patch Verification Checklist for DevOps Teams

After upgrading, validate both the software version and application behavior.

• Runtime: Confirm the production process uses Node.js 22.23.4, 24.22.1, 26.12.1 or a later relevant fixed build.
• Containers: Verify active images and inspect for older replicas or jobs.
• HTTPS: Test outbound TLS connections and certificate validation behavior.
• DNS: Confirm applications using DNS resolution continue to handle expected destinations correctly.
• Compression: Exercise normal Brotli-compressed request or response workflows.
• HTTP: Verify keep-alive behavior through legitimate integration tests.
• Snapshots: Review startup snapshots and single executable applications if used.
• Filesystem permissions: Recheck Permission Model behavior where the application depends on it.
• CI/CD: Confirm build runners do not package an older runtime.
• Monitoring: Watch application errors, restarts and unexpected security events after deployment.

Do not execute untrusted exploit samples against production services solely to confirm that the vulnerability exists.

Use authorized testing and the official version-specific remediation evidence.

Is the Node.js Brotli Vulnerability Actively Exploited?

The project’s October 21 advisory does not establish that CVE-2026-111497 is being actively exploited in the wild.

It confirms a High-severity vulnerability with potential remote-code-execution impact.

Those facts justify timely patching, particularly when applications process untrusted compressed data.

However, a possible RCE outcome is not the same as a verified breach, published exploit campaign or evidence that every Node.js web server can be taken over remotely.

Security teams should monitor official Node.js updates and trusted vulnerability intelligence for new exploitation information.

If suspicious application behavior or evidence of compromise exists, investigate it separately rather than assuming that a runtime upgrade resolves an already established intrusion.

Confirmed vs Unknown

Confirmed by the Node.js Project

• Ten vulnerabilities were addressed in the October 21, 2026 security release.
• Four vulnerabilities are rated High.
• CVE-2026-111497 involves a Brotli decoder out-of-bounds write that permits remote code execution.
• Several flaws affect TLS hostname verification, DNS handling and runtime permission enforcement.
• Fixes are available for the 22.x, 24.x and 26.x release branches.
• Patched versions are 22.23.4, 24.22.1 and 26.12.1.
• Additional dependency and certificate-store updates are included.

Not Established by the Public Advisory

• Confirmed widespread exploitation of these new CVEs.
• A verified number of compromised Node.js installations.
• A universal unauthenticated exploit chain against every Node.js application.
• That all 10 vulnerabilities affect every branch.
• That the affected TLS flaws break encryption algorithms.
• That all Node.js cryptographic random-number functions are predictable.
• A specific threat actor responsible for exploiting this release’s vulnerabilities.

CyberUpdates365 Analysis

Node.js security releases matter because application developers often think of dependencies as npm packages while overlooking the runtime that executes them.

Updating a vulnerable library does not necessarily address a flaw inside Node.js itself.

The October release illustrates that distinction through vulnerabilities affecting built-in networking, cryptography, compression and permission-handling behavior.

The Brotli issue presents an especially important consideration for services that accept compressed data from external sources.

Such services should review their exposure and upgrade the runtime without assuming that application-level input checks cover every memory-safety weakness in a decoder.

The TLS and DNS findings raise a different concern.

Security checks can fail when components disagree about how a hostname or IP address should be interpreted.

For systems that validate user-provided destinations, maintain allowlists or initiate outbound HTTPS connections, consistent name interpretation is part of the security boundary.

The random-value issue demonstrates the need to consider application packaging models.

Startup snapshots and single executable applications change how runtime state is carried into new processes.

A value that was intended to be unique can become unsafe if state is copied across processes in an unexpected way.

From an operational perspective, the biggest challenge may be finding all Node.js installations.

Large organizations often have separate runtime copies inside build agents, Docker images, backend services, utility containers and developer environments.

A release may appear patched in a repository while an older binary continues running in production.

That makes post-deployment version verification as important as the upgrade itself.

The central lesson is that Node.js runtime security, application dependencies and production deployment verification must be managed together.

Research Evidence

• Vendor/project: Node.js.
• Security release: October 21, 2026.
• Number of CVEs: 10.
• Severity: Four High, three Medium and three Low.
• Highest-impact listed issue: CVE-2026-111497, Brotli decoder remote code execution.
• Other High CVEs: CVE-2026-105482, CVE-2026-105483 and CVE-2026-106069.
• Medium CVEs: CVE-2026-105481, CVE-2026-106072 and CVE-2026-106074.
• Low CVEs: CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073.
• Patched Node.js 22.x: 22.23.4.
• Patched Node.js 24.x: 24.22.1.
• Patched Node.js 26.x: 26.12.1.
• Confirmed active exploitation: Not established by the cited advisory.
• Recommended response: Upgrade affected runtimes, redeploy applications and verify the actual production version.

Frequently Asked Questions

How many vulnerabilities were fixed in the October 2026 Node.js update?

Node.js fixed 10 vulnerabilities: four High, three Medium and three Low.

Which Node.js versions contain the security fixes?

Node.js 22.23.4, 24.22.1 and 26.12.1 contain the relevant October security fixes for their respective branches.

Can the Node.js Brotli flaw allow remote code execution?

Yes. The official advisory identifies CVE-2026-111497 as a High-severity Brotli decoder out-of-bounds write that permits remote code execution. Detailed exploitation prerequisites are not provided in the short advisory.

Does the update fix TLS certificate validation problems?

Yes. It includes multiple fixes for incorrect hostname and IP-address interpretation during certificate verification.

Are all three Node.js branches affected by every CVE?

No. Some vulnerabilities affect only Node.js 26.x, while CVE-2026-105483 affects 24.x and 26.x but is not listed for 22.x.

How can I check whether my Node.js runtime is patched?

Run node --version in the relevant environment and compare the result with the fixed release for that branch. Production containers and servers must be checked separately.

Do Docker and Kubernetes applications need rebuilding?

They generally need updated runtime images and redeployment where the current image contains an affected Node.js build. Verify the running containers after the rollout.

Are these Node.js vulnerabilities actively exploited?

The official October 21 advisory does not establish confirmed active exploitation of the newly disclosed flaws.

Final Takeaway

The October 2026 Node.js security update fixes 10 vulnerabilities, including a potentially serious Brotli decoder remote-code-execution issue and several certificate-verification weaknesses.

The affected branches are Node.js 22.x, 24.x and 26.x, with patched releases 22.23.4, 24.22.1 and 26.12.1.

Developers and administrators should identify affected runtime versions, update their deployment images and verify that production applications are using the intended patched builds.

The priority is not simply installing an update locally, but confirming that every relevant Node.js workload is actually running a secure release.

Securing JavaScript backends and the infrastructure supporting them?

Node.js vulnerabilities are not the only risk to application availability and data security. Our Apache Tomcat investigation explains how authentication and protocol-handling weaknesses can affect another widely used application server.

Read: Apache Tomcat Fixes 8 Security Flaws, Including Authentication Bypass →

Official Sources

• Node.js — October 21, 2026 Security Advisory
• Node.js — Version 26.12.1 Security Release
• Node.js — Version 24.22.1 Security Release
• Node.js — Version 22.23.4 Security Release