# Node.js fixes Brotli code-execution risk and TLS hostname bypasses in October security release

Node.js 26.12.1, 24.22.1 and 22.23.4 patch ten issues, including a high-severity Brotli decoder out-of-bounds write with remote-code-execution potential and TLS hostname validation bypasses.

The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.

- Status: Active
- Published: 2026-10-22T06:16:11+13:00
- Updated: 2026-10-22T06:16:11+13:00
- Categories: Web Development, JavaScript, Developer Tools
- Tags: Node.js, security
- Canonical HTML: https://beyondthe.news/dossiers/nodejs-october-2026-brotli-rce-tls-dns-security-release

## What changed

On October 21, 2026, Node.js released security updates 26.12.1, 24.22.1 and 22.23.4 for ten vulnerabilities. CVE-2026-111497 is a high-severity Brotli decoder out-of-bounds write that may permit remote code execution. CVE-2026-105483 and CVE-2026-106069 affect TLS hostname verification, and CVE-2026-105482 truncates DNS names containing NUL. Dependency updates cover c-ares, eMudhra certificate distrust, Undici, and branch-specific OpenSSL and SQLite.

## Why it matters

Applications can be exposed through decompression of untrusted data and outbound connections to attacker-influenced hostnames even if their own application logic is unchanged. Security impact depends on the exact execution path; the advisory does not establish that every Node.js server is remotely exploitable. The patched versions span current and supported LTS lines, while unsupported lines do not receive project fixes.

## Brotli and code execution

CVE-2026-111497 affects 22.x, 24.x and 26.x. The Node.js project describes an out-of-bounds write in the Brotli decoder that permits remote code execution. Review compressed-input exposure, but install the patched runtime rather than relying on speculative filtering.

## Hostname verification and DNS

CVE-2026-105483 affects 24.x/26.x hostname validation of fullwidth-digit IPs; CVE-2026-106069 affects loosely parsed IP hostnames on all three lines; CVE-2026-105482 concerns NUL-truncated DNS names. Outbound HTTP clients and server-side URL fetchers deserve particular scrutiny.

## Other changes

The release also covers keep-alive socket response ordering, noncanonical IPv4 SAN checks, startup snapshot/SEA random entropy reuse, ZIP header validation and Permission Model filesystem over-grants. The project rates the highest severity HIGH. Updates include eMudhra CA trust changes and branch-specific library fixes.

## Upgrade steps

Update to 26.12.1, 24.22.1 or 22.23.4 as appropriate. Rebuild container images, restart services and verify the actual executable used by workers, scripts, CI and managed deployments. Distribution backports may have different package version strings.

## Evidence limits

The Node.js project's October 21 advisory supplies the affected lines, CVEs and patched versions. Independent security reporting corroborates the release but does not establish exploitation prevalence or universal attack prerequisites. BTN's earlier July Node.js security dossier concerns different issues.

## Key details

- October 21, 2026 security release; fixed 26.12.1, 24.22.1 and 22.23.4.
- Ten vulnerabilities; highest severity HIGH.
- CVE-2026-111497 Brotli out-of-bounds write with RCE potential.
- TLS hostname bypasses CVE-2026-105483 and CVE-2026-106069.
- CVE-2026-105482 DNS NUL truncation.
- Includes eMudhra CA trust and dependency updates.

## Builder takeaways

- Upgrade every active Node.js runtime, including containers and CI.
- Audit compressed-input and outbound-hostname exposure.
- Confirm managed hosting and distro images contain fixes.
- Do not confuse these October CVEs with July security updates.

## What to watch

- Distribution and managed-runtime patch rollout.
- Additional exploitability clarification and field exploitation reports.
- Compatibility regressions after the patch.

## Uncertainties

- Exploitability depends on application exposure.
- Widespread exploitation is not established by the primary advisory.
- Downstream package versions and rollout times vary.

## Sources

- [Wednesday, October 21, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) — Node.js Project · primary security advisory · 2026-10-21T00:00:00+13:00. CVE details, affected lines and patch versions.
- [Node.js v24.22.1 (LTS)](https://nodejs.org/en/blog/release/v24.22.1) — Node.js Project · primary release notes · 2026-10-21T00:00:00+13:00. Release line confirmation.
- [Node.js releases security updates to fix TLS, DNS and Brotli vulnerabilities](https://cybersecuritynews.com/node-js-releases-security-updates/) — Cybersecurity News · independent specialist report · 2026-10-21T00:00:00+13:00. Independent corroboration of release.