- What: On 21 October 2026 Node.js released 26.12.1, 24.22.1 and 22.23.4, fixing 10 vulnerabilities. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder.
- Impact: Node.js rates it High and says it permits remote code execution. A public proof-of-concept published on 22 October reached code execution only against a deliberately weakened test build; on a standard build its author reported a crash and a limited read of process memory. No exploitation in the wild has been reported as of 22 October.
- Fix: Node.js 26.12.1, 24.22.1 and 22.23.4. The patched releases reject the malformed input the proof-of-concept uses.
- Who: Any Node.js 22, 24 or 26 process that decompresses Brotli data an attacker controls: request bodies, the node:zlib Brotli APIs, and responses fetched with fetch(), which decompresses Brotli automatically.
The Node.js security advisory for Wednesday, 21 October 2026 lists 10 vulnerabilities fixed in three releases: Node.js 26.12.1, the latest release; 24.22.1, the latest LTS; and 22.23.4. Four are rated High, three Medium and three Low. Every supported release line is affected by at least one of them, and the advisory repeats the project's standing rule that end-of-life versions are always affected when a security release ships.
The Brotli flaw
CVE-2026-111497 is described by Node.js as an out-of-bounds write in its Brotli decoder that "permits remote code execution." It affects the 26.x, 24.x and 22.x lines. The advisory does not say which input triggers it or which APIs reach it.
The fuller picture comes from the public proof-of-concept, reported by The Hacker News. It was published on 22 October and uses malformed compressed input. Against a deliberately weakened test build it reached code execution. Against a standard Node.js build, its author reported a crash and a limited read of process memory, not code execution, and said a working attack on normal builds was not achieved. The patched releases reject the input it uses. No exploitation in the wild had been reported as of 22 October.
That gap matters for how to read the rating. Node.js calls the flaw remote code execution, and an out-of-bounds write is the class of bug that becomes one. What has been shown publicly so far on a standard build is a crash, which is a denial of service on any service that decodes attacker-supplied Brotli, plus a partial memory read.
Who is exposed
The exposure is any Node.js process that decompresses Brotli data an attacker can shape. Per The Hacker News, that covers three paths:
- Servers that decompress Brotli request bodies.
- Code that calls the node:zlib Brotli decompression APIs on input from outside.
- Code that calls fetch() against a server that answers with Brotli, because fetch() decompresses those responses automatically. A backend that only ever sends requests is still decoding whatever the other side returns.
The third path is the one most likely to be missed in an inventory. A service with no public listener at all, such as a worker that calls a third-party API or follows a webhook to a URL a user supplied, still runs the decoder on bytes it did not write.
The other nine
Three more flaws are rated High. Two of them, CVE-2026-105483 and CVE-2026-106069, are TLS certificate hostname checks that can be bypassed with non-canonical ways of writing an IP address. A third, CVE-2026-105482, has dns.resolve truncating names at an embedded NUL character. The full list from the advisory:
| CVE | Severity | Issue | Lines |
|---|---|---|---|
| CVE-2026-111497 | High | Brotli decoder out-of-bounds write permits remote code execution | 26.x, 24.x, 22.x |
| CVE-2026-105482 | High | dns.resolve truncates names containing a NUL character | 26.x, 24.x, 22.x |
| CVE-2026-105483 | High | TLS certificate hostname bypass when the IP is written in fullwidth digits | 26.x, 24.x |
| CVE-2026-106069 | High | TLS certificate hostname bypass when the host loosely resolves to an IP address | 26.x, 24.x, 22.x |
| CVE-2026-105481 | Medium | Keep-alive socket processes a response written before the request was sent | 26.x, 24.x, 22.x |
| CVE-2026-106072 | Medium | Improper certificate validation for non-canonical IPv4 hostnames lets DNS SANs authenticate IP endpoints | 26.x, 24.x, 22.x |
| CVE-2026-106074 | Medium | crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs | 26.x, 24.x, 22.x |
| CVE-2026-106070 | Low | ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation | 26.x |
| CVE-2026-106071 | Low | Permission Model filesystem over-grant via wildcard radix lookup | 26.x |
| CVE-2026-106073 | Low | Permission Model bypass with fs.realpathSync | 26.x, 24.x, 22.x |
What RedEye is watching
Two things would change the urgency here. The first is a proof-of-concept that reaches code execution on a standard build rather than a weakened one, which would turn a crash into a takeover on any exposed service. The second is exploitation of the TLS hostname bypasses, which do not need a decoder at all and touch every Node.js client that verifies certificates against an IP address. Neither had been reported as of 22 October.
Sources: the Node.js security advisory of 21 October 2026, and The Hacker News on the proof-of-concept and exposure.
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us