Node.js fixes 3 high-severity vulnerabilities in TLS, DNS, Brotli

Key Takeaways

• Node.js has issued critical security updates across its 26.x, 24.x, and 22.x branches.
• Ten vulnerabilities have been addressed, including four high-severity flaws.
• The most critical vulnerability, CVE-2026-111497, could lead to remote code execution via the Brotli decoder.
• Other high-severity issues affect TLS certificate validation and DNS name resolution.
• Users are urged to update to versions 26.12.1, 24.22.1, and 22.23.4 immediately.

Node.js has rolled out significant security patches for its active release lines, 26.x, 24.x, and 22.x, addressing a total of ten vulnerabilities. Among these, four are classified as high-severity, posing substantial risks related to DNS lookups, TLS certificate verification, and Brotli decompression capabilities.

The updated versions, released on October 21, 2026, are identified as 26.12.1, 24.22.1, and 22.23.4. Developers and system administrators are strongly advised to implement these updates without delay, as one vulnerability could potentially enable remote code execution.

Beyond the critical issues, the October security release also includes fixes for various components, such as HTTP connection handling, generation of random values, ZIP file processing, and filesystem permission checks. The highest risk across all supported branches is consistently categorized as high severity.

High-Severity Vulnerabilities Detailed

A critical flaw, CVE-2026-111497, impacts the Brotli decoder across all three Node.js release lines. This vulnerability describes an out-of-bounds write, which could be exploited to achieve remote code execution. This means the decoder might write data beyond its designated memory boundaries. Applications that process untrusted Brotli-compressed data are particularly susceptible and should be prioritized during the patching process. The specific conditions required for exploitation, however, have not been fully disclosed.

Two other high-severity vulnerabilities pertain to Transport Layer Security (TLS) certificate hostname validation. CVE-2026-105483 allows for a hostname verification bypass if an IP address contains full-width digits, affecting Node.js versions 26.x and 24.x. Similarly, CVE-2026-106069 addresses issues where hostnames loosely resolve to an IP address, impacting all three branches. Both vulnerabilities revolve around the critical process of ensuring a certificate genuinely corresponds to its intended destination.

The fourth high-severity issue, CVE-2026-105482, involves the dns.resolve function, which can truncate names containing a NUL character. This flaw affects all three release lines and raises concerns for applications that rely on precise name handling before initiating DNS lookups. These recent fixes build upon previous Node.js patches that also targeted TLS authentication bypasses and discrepancies in hostname and certificate handling.

Medium and Low-Severity Fixes

The update also encompasses three medium-severity issues. CVE-2026-105481 addresses a flaw in HTTP connection handling where a keep-alive socket might process a response before its corresponding request has been sent. CVE-2026-106072 concerns improper certificate validation for nonstandard IPv4 hostnames, potentially allowing DNS certificate names to authenticate IP endpoints incorrectly. Lastly, CVE-2026-106074 impacts cached random data in startup snapshots and single executable applications, leading to repeated values from crypto.randomUUID() and crypto.randomInt(). All three medium-severity vulnerabilities affect the 26.x, 24.x, and 22.x branches.

Several low-severity issues have also been resolved. CVE-2026-106070 addresses instances where attacker-controlled bytes are returned after failed ZIP header checks, affecting only Node.js 26.x. CVE-2026-106071 could grant excessive filesystem access through wildcard matching, also specific to 26.x. Finally, CVE-2026-106073 allows a bypass of Permission Model checks via fs.realpathSync across all three branches, echoing previous Permission Model vulnerabilities that exposed gaps in filesystem restrictions.

The official Node.js security announcement also notes updates to several underlying components, including c-ares, CA certificates, Undici, OpenSSL, and SQLite, with component-specific branch coverage.

What You Should Do

• Immediately deploy the corresponding patched Node.js release for your environment (26.12.1, 24.22.1, or 22.23.4).
• Rebuild any application images that rely on the affected Node.js versions.
• Restart all affected Node.js services to ensure the patches are fully applied.
• Conduct thorough testing of outbound HTTPS connections, DNS handling, applications processing compressed content, and workloads with permission restrictions.
• Migrate any applications running on end-of-life Node.js branches to a currently supported version, as unsupported branches will not receive these security fixes.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.