An out-of-bounds write in a compression module used by millions of applications can enable remote code execution – and it affects three active Node.js release lines at once. That is exactly what happened on October 21, 2026, when the Node.js project released an urgent security update fixing eight vulnerabilities, including one with high criticality in the Brotli decoder.
Just days earlier, the MariaDB team had to close critical SQL injection flaws in the MariaDB Connector/Node.js – another example of how closely security in the Node.js ecosystem is tied to its dependencies.For developers, admins, and IT security teams, this update is not optional routine patching. The affected components – Brotli decompression, TLS certificate verification, and DNS resolution – are core to nearly every production Node.js application. This article breaks down the facts and provides concrete recommendations.
Table of Contents
Key Takeaways
- Node.js v26.12.1, v24.22.1, and v22.23.4 close a total of eight security vulnerabilities, released on October 21, 2026.
- CVE-2026-111497 (Brotli decoder, out-of-bounds write) is the most critical individual flaw, rated high severity with potential for remote code execution.
- Two TLS certificate bypass flaws (CVE-2026-105483 and CVE-2026-106069) allow hostname verification to be bypassed under certain conditions.
- c-ares, a compromised eMudhra intermediate CA certificate, OpenSSL, SQLite, and Undici were also updated.
- On the very same day, the PHP project also released an emergency update fixing two critical RCE flaws – a notable timing coincidence for both major backend technologies.
What the October 21, 2026 Node.js Security Release Covers
On Wednesday, October 21, 2026, the Node.js project released patches for three actively maintained release lines:
| Release Line | New Version |
|---|---|
| Node.js 26.x | v26.12.1 |
| Node.js 24.x | v24.22.1 |
| Node.js 22.x | v22.23.4 |
These lines cover both the current and the LTS versions that many companies run in production. Anyone operating one of these three lines should treat this update as a priority.
Alongside the actual code fixes, this Node.js security update also updates several dependencies:
- c-ares – the underlying DNS library
- CA certificate bundle – due to a compromised eMudhra intermediate CA certificate
- OpenSSL – on the 24.x and 22.x lines
- SQLite – on the 22.x line
- Undici – on all three lines (26.x, 24.x, 22.x)
The CA certificate bundle update deserves particular attention: a compromised intermediate CA certificate from eMudhra was removed from the trust store. Such certificates could theoretically be abused to issue forged certificates, which makes their removal from the trust chain an important safeguard.
The Most Critical Flaw: Brotli Decoder Enables Remote Code Execution
At the center of this Node.js security update is CVE-2026-111497. It is an out-of-bounds write in Node.js’s Brotli decoder.
Brotli is a compression format natively bundled with Node.js and used, among other things, when processing compressed HTTP responses. Whenever a Node.js application receives Brotli-compressed data – such as responses from external APIs or proxy servers – this decoder comes into play.
An out-of-bounds write means a program writes to memory regions that lie outside the buffer actually allocated for it. As a result, memory reserved for other purposes can be overwritten – a classic entry point for remote code execution.
The flaw was reported by mcollina and fixed by aduh95 – both well-known names within Node.js core development. It is rated “high” severity and affects all three updated lines: 26.x, 24.x, and 22.x.
Why is this particularly dangerous? Because an attacker may not need any direct interaction with the target application at all – it’s enough for the application to process a crafted, Brotli-compressed response. Servers that decompress data from third parties, reverse proxies, and microservice architectures with internal compression are all potentially exposed.
TLS Certificate Bypass: When Hostname Verification Fails
Besides the Brotli flaw, the update contains two further “high”-rated vulnerabilities affecting TLS certificate verification:
CVE-2026-105483 describes a TLS certificate hostname bypass that occurs when IP addresses are specified using fullwidth digits. These are Unicode characters that look visually like normal digits but are technically encoded differently. The verification routine apparently fails to correctly recognize this representation as an IP address, allowing hostname validation to be bypassed. Lines 26.x and 24.x are affected.
CVE-2026-106069 is a similarly structured TLS certificate hostname bypass that occurs when a hostname loosely resolves to an IP address. Here too, validation of the certificate against the actual connection partner can fail. This flaw affects all three lines: 26.x, 24.x, and 22.x.
Both weaknesses can become relevant in practice for man-in-the-middle attacks: an attacker could position themselves between client and actual server and appear trustworthy despite a faulty or foreign certificate. For applications that establish TLS connections to external services and rely on built-in certificate verification, this is a serious risk.
Another High-Severity Flaw: Faulty DNS Name Truncation
CVE-2026-105482 affects the dns.resolve function, which incorrectly truncates names containing NUL characters. This flaw likewise affects all three lines 26.x, 24.x, and 22.x. NUL-byte issues are a known pattern in software security: if a string is cut off at a point the developer did not expect, checks can be bypassed or resolutions manipulated.
Medium-Severity Vulnerabilities
In addition to the four high-severity flaws, three vulnerabilities of medium criticality were fixed:
- CVE-2026-105481: A keep-alive socket can process a response that was already written before the actual request was sent – a timing issue with reused connections.
- CVE-2026-106072: Faulty certificate validation for non-canonical IPv4 hostnames allows DNS SANs (Subject Alternative Names) to authenticate IP endpoints, even though this is not intended.
- CVE-2026-106074: The entropy caches of
crypto.randomUUID()andrandomInt()are saved into startup snapshots or Single Executable Applications (SEAs). As a result, every process started from the same snapshot can repeatedly generate the same values – a problem for applications relying on genuine randomness, such as session tokens or UUIDs.
Low-Severity Flaws Limited to Node.js 26.x
Two lower-severity vulnerabilities affect only the current 26.x line:
- CVE-2026-106070: The Node.js ZipFile implementation returns attacker-controlled prefix bytes after a failed ZIP header validation.
- CVE-2026-106071: In the Permission Model, a wildcard radix lookup leads to over-granted filesystem permissions.
Even though their severity rating is low, they should be fixed as part of the update that’s already pending anyway.
Recommendations for Node.js Admins
Given the criticality – particularly of the RCE-capable Brotli flaw and the TLS bypass issues – the following approach is recommended:
- Check immediately which Node.js version is running in production. Anyone running 26.x, 24.x, or 22.x is affected by at least one of the high-severity flaws.
- Apply the patch: update to v26.12.1, v24.22.1, or v22.23.4 respectively, depending on the line in use.
- Check dependencies in CI/CD pipelines: Docker base images, build servers, and deployment scripts should reference the new version numbers.
- Prioritize applications using Brotli decompression: services that process external or not-fully-trusted compressed content should be updated first.
- Retest TLS connections to critical services after the update, especially where hostnames are resolved dynamically or international character sets are used.
- Verify certificate trust: confirm the updated CA certificate bundle is correctly delivered and that the compromised eMudhra intermediate certificate is no longer classified as trustworthy.
- Strengthen monitoring: after patching, logs should be checked for unusual TLS errors or connection failures, since stricter certificate checks can in rare cases affect existing, misconfigured connections.
A Striking Coincidence With the PHP Security Release
Notably, on the same day – October 21, 2026 – the PHP project also released its own emergency security update. PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 close two critical RCE flaws with a CVSS score of 9.2. Both incidents are independent of one another and affect different technology stacks. Still, the timing coincidence shows that teams running both Node.js- and PHP-based systems had to carry out two critical patch cycles in parallel on this single day.
Bottom Line
The Node.js security update released on October 21, 2026 belongs to the category of updates that should not be postponed. The combination of an RCE-capable Brotli flaw with high severity, two TLS certificate bypass issues, and a faulty DNS name-handling bug makes clear how deeply the affected components are embedded in widely used Node.js applications.
For developers and IT security teams: versions v26.12.1, v24.22.1, and v22.23.4 should be rolled out to production environments promptly. Anyone running Node.js in containers, serverless environments, or classic server setups should check the patch status of their systems today and prioritize the update – particularly wherever compressed HTTP responses are processed or TLS connections to external services are established.
