Node.js Releases Security Updates to Fix High-Severity TLS, DNS and Brotli Vulnerabilities

Node.js has released security updates for its 26.x, 24.x, and 22.x branches to address ten vulnerabilities, including four high-severity flaws affecting DNS lookups, TLS certificate checks, and Brotli decompression.

The supplied release details identify 26.12.1, 24.22.1, and 22.23.4 as the patched versions. The most serious potential outcome is remote code execution through the Brotli decoder.

The October security update also covers HTTP connection handling, repeated random values, ZIP processing, and filesystem permission checks. Node.js scheduled the releases for October 21, 2026, and listed high severity as the highest risk across all three supported branches.

CVE-2026-111497 affects the Brotli decoder in all three release lines. The supplied advisory describes an out-of-bounds write that permits remote code execution.

This means the decoder can write outside its intended memory area. Applications that process untrusted Brotli-compressed content should receive particular attention during patch planning. However, the supplied notice does not explain the exact conditions needed for exploitation.

Two high-severity vulnerabilities involve TLS certificate hostname checks. CVE-2026-105483 allows a hostname verification bypass when an IP address uses full-width digits, affecting Node.js 26.x and 24.x.

Node.js Releases Security Updates

CVE-2026-106069 involves hostnames that loosely resolve to an IP address and affects all three branches. Both concern whether a certificate correctly matches the intended destination.

The fourth high-severity issue, CVE-2026-105482, causes dns.resolve to truncate names containing a NUL character. It affects all three release lines. The flaw raises concerns for applications that depend on consistent name handling before performing DNS lookups.

These fixes follow earlier Node.js TLS authentication bypass patches, which also addressed differences in hostname handling and certificate verification.

Three medium-severity issues broaden the update’s scope. CVE-2026-105481 allows a keep-alive socket to process a response written before its request was sent.

CVE-2026-106072 concerns improper certificate validation for nonstandard IPv4 hostnames, allowing DNS certificate names to authenticate IP endpoints.

CVE-2026-106074 affects cached random data stored in startup snapshots and single executable applications. Processes created from these artifacts can repeat values returned by crypto.randomUUID() and crypto.randomInt(). All three medium-severity flaws affect the 26.x, 24.x, and 22.x branches.

The remaining issues carry low ratings. CVE-2026-106070 concerns attacker-controlled bytes returned after failed ZIP header checks. CVE-2026-106071 can grant excessive filesystem access through wildcard matching. Both affect 26.x.

CVE-2026-106073 bypasses Permission Model checks through fs.realpathSync across all three branches. Previous Node.js Permission Model vulnerabilities also exposed gaps in filesystem restrictions.

The release details also list updates to c-ares, CA certificates, Undici, OpenSSL, and SQLite, with branch coverage varying by component.

Administrators should deploy the matching patched release, rebuild application images where needed, and restart affected services. Testing should cover outbound HTTPS connections, DNS handling, compressed content, and permission-restricted workloads.

Teams should consult the official Node.js security announcement and avoid unsupported versions. The project warns that end-of-life branches remain affected even after security releases, so migrating to a supported branch is an important part of remediation.

Editorial verification note: The live announcement retrieved during research still displayed the advance release notice, without the detailed CVEs or patched downloads. Those details above come from the release text you supplied and should be checked against the updated announcement before publication.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.