Node.js Patches 10 Security Vulnerabilities, Including High-Severity RCE Flaw

The Node.js Project released security updates on October 21, 2026, addressing 10 vulnerabilities across its 26.x, 24.x, and 22.x release lines.

The updates fix a critical Brotli decoder flaw that allows remote code execution, as well as weaknesses in DNS resolution, TLS certificate validation, cryptographic randomness, and filesystem permissions.

The release addresses four high-severity, three medium-severity, and three low-severity vulnerabilities. The patched versions are Node.js 26.12.1, 24.22.1, and 22.23.4.

Although all three release lines have received security updates, individual vulnerabilities affect different branches, making version-specific assessments important.

Node.js Patches Vulnerabilities

The most significant issue, CVE-2026-111497, involves an out-of-bounds write in the Node.js Brotli decoder that allows remote code execution. Node.js versions 26.x, 24.x, and 22.x are affected. Developer mcollina reported the vulnerability, and aduh95 implemented the fix.

The advisory does not provide detailed prerequisites for exploitation, payload characteristics, or evidence of active exploitation.

Therefore, the disclosure should not be interpreted as indicating that every application running an affected release is remotely exploitable. The confirmed scope is limited to the decoder vulnerability and the three affected release lines.

Three additional high-severity issues concern hostname handling:  

• CVE-2026-105482 causes dns.resolve to truncate names containing NUL characters.  
• CVE-2026-105483 bypasses TLS certificate hostname checks when an IP address uses full-width digits.  
• CVE-2026-106069 affects hosts that loosely resolve to IP addresses.

The following table summarizes all 10 vulnerabilities and their affected release lines, as detailed in the project’s security announcement. Severity labels reflect the project’s classifications rather than independently assigned risk scores.

CVE-2026-106074 affects the entropy caches used by crypto.randomUUID() and randomInt(). These caches can be preserved in user-land startup snapshots and single-executable applications, causing processes to repeat the same values. This issue concerns duplicated cached randomness across processes rather than a general failure of every cryptographic operation.

The release also updates c-ares, Undici, and CA certificates across all three branches. The certificate update addresses the eMudhra Intermediate CA compromise.

OpenSSL is updated in versions 24.x and 22.x, while SQLite is updated in version 22.x. These dependency changes accompany the listed Node.js vulnerabilities.

Administrators should upgrade affected deployments to Node.js versions 26.12.1, 24.22.1, or 22.23.4, depending on their release branch. The project warns that end-of-life versions remain affected even after security releases and advises users to switch to maintained versions.

The announcement offers no workarounds for these flaws, so installing the patched runtime is the recommended remediation for affected deployments across the specified branches.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.