What changed
On October 21, 2026, Node.js released security updates 26.12.1, 24.22.1 and 22.23.4 for ten vulnerabilities. CVE-2026-111497 is a high-severity Brotli decoder out-of-bounds write that may permit remote code execution. CVE-2026-105483 and CVE-2026-106069 affect TLS hostname verification, and CVE-2026-105482 truncates DNS names containing NUL. Dependency updates cover c-ares, eMudhra certificate distrust, Undici, and branch-specific OpenSSL and SQLite.
Why it matters
Applications can be exposed through decompression of untrusted data and outbound connections to attacker-influenced hostnames even if their own application logic is unchanged. Security impact depends on the exact execution path; the advisory does not establish that every Node.js server is remotely exploitable. The patched versions span current and supported LTS lines, while unsupported lines do not receive project fixes.
Brotli and code execution
CVE-2026-111497 affects 22.x, 24.x and 26.x. The Node.js project describes an out-of-bounds write in the Brotli decoder that permits remote code execution. Review compressed-input exposure, but install the patched runtime rather than relying on speculative filtering.
Hostname verification and DNS
CVE-2026-105483 affects 24.x/26.x hostname validation of fullwidth-digit IPs; CVE-2026-106069 affects loosely parsed IP hostnames on all three lines; CVE-2026-105482 concerns NUL-truncated DNS names. Outbound HTTP clients and server-side URL fetchers deserve particular scrutiny.
Other changes
The release also covers keep-alive socket response ordering, noncanonical IPv4 SAN checks, startup snapshot/SEA random entropy reuse, ZIP header validation and Permission Model filesystem over-grants. The project rates the highest severity HIGH. Updates include eMudhra CA trust changes and branch-specific library fixes.
Upgrade steps
Update to 26.12.1, 24.22.1 or 22.23.4 as appropriate. Rebuild container images, restart services and verify the actual executable used by workers, scripts, CI and managed deployments. Distribution backports may have different package version strings.
Evidence limits
The Node.js project's October 21 advisory supplies the affected lines, CVEs and patched versions. Independent security reporting corroborates the release but does not establish exploitation prevalence or universal attack prerequisites. BTN's earlier July Node.js security dossier concerns different issues.