The Node.js project has released security updates for all three of its supported release lines, fixing ten vulnerabilities including an out-of-bounds write in the built-in Brotli decoder that, in the project's own words, permits remote code execution. The fixed builds are Node.js 22.23.4 (LTS), 24.22.1 (LTS) and 26.12.1 (Current), according to the Node.js October 2026 security release notes.
Four of the ten issues are rated high, three medium and three low. Node.js publishes severity ratings rather than CVSS scores on its release page and does not explain how any of the bugs can be triggered, so the detail below is limited to what the project published. Hong Kong's HKCERT has also flagged the release.
A code execution bug and two TLS bypasses lead the list
- CVE-2026-111497 (high): an out-of-bounds write in the Brotli decoder that permits remote code execution. It affects 26.x, 24.x and 22.x and was reported by mcollina and fixed by aduh95.
- CVE-2026-106069 (high): a TLS certificate hostname bypass when the host loosely resolves to an IP address. All three lines are affected.
- CVE-2026-105483 (high): a TLS certificate hostname bypass when the IP address is written in fullwidth digits. Only 26.x and 24.x are affected.
- CVE-2026-105482 (high): dns.resolve truncates names that contain a NUL character. All three lines are affected.
A medium-rated bug touches the same area: under CVE-2026-106072, improper certificate validation for non-canonical IPv4 hostnames allows DNS names in a certificate to authenticate IP endpoints. Three separate fixes to how Node.js matches certificates against hosts make this release a priority for services that rely on the runtime to verify who they are talking to.
Repeated random values in snapshots
Another medium issue, CVE-2026-106074, means the entropy caches behind crypto.randomUUID() and randomInt() were saved into user-land startup snapshots and single executable applications (SEAs), so every process started from them repeats the same values. Teams that ship Node.js as a snapshot or SEA should check whether they rely on those functions. The third medium fix, CVE-2026-105481, concerns a keep-alive socket processing a response that was written before the request was sent.
The low-rated fixes cover the Node.js Permission Model, which limits what a process can reach on disk: a filesystem over-grant via wildcard radix lookup (CVE-2026-106071, 26.x only) and a bypass using fs.realpathSync (CVE-2026-106073, all lines). The third, CVE-2026-106070 (26.x only), makes ZipFile return attacker-controlled prefix bytes after failed ZIP header validation.
Bundled dependencies updated, including the eMudhra CA change
The release also updates c-ares and Undici on all three lines, OpenSSL on 24.x and 22.x, and SQLite on 22.x. It changes the bundled CA certificates as well, to address the eMudhra intermediate CA compromise we covered in Botched key ceremony leaves eMudhra CAs open to forgery.
Update to 22.23.4, 24.22.1 or 26.12.1
Upgrade every Node.js runtime to one of the fixed versions, including runtimes baked into container images. The project notes that end-of-life versions are always affected when a security release occurs, so anything on an unsupported line will not receive these fixes and should move to a supported one.
The release notes do not mention exploitation of any of the ten bugs. The Brotli fix still belongs at the top of the queue, because it is the only issue in the release that Node.js itself describes as permitting remote code execution.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.