Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including a Brotli remote code execution flaw and TLS hostname bypasses

The Node.js project shipped security releases on 21 October 2026 for its three supported lines: 26.12.1, 24.22.1 and 22.23.4. Between them they fix ten CVEs, four rated high, including a flaw in the bundled Brotli decoder that the project says "permits remote code execution", two TLS hostname-verification bypasses and a DNS bug that lets a name be silently cut short. The release also blocks certificate chains through the eight compromised eMudhra intermediate certificates, a problem we covered earlier this week. Anyone running Node.js in production, or shipping it inside a container image, should plan an upgrade today.

Key points

• Node.js 26.12.1 (Current), 24.22.1 (LTS) and 22.23.4 (LTS) were released on 21 October 2026 and fix ten CVEs: four high, three medium and three low.
• The high-severity issues are CVE-2026-111497 (out-of-bounds write in the Brotli decoder, which the project says permits remote code execution), CVE-2026-105482 (dns.resolve truncates names containing a NUL character), and TLS hostname-verification bypasses CVE-2026-105483 and CVE-2026-106069.
• CVE-2026-111497, CVE-2026-105482 and CVE-2026-106069 affect all three lines; CVE-2026-105483 affects 26.x and 24.x only.
• The release adds a blocklist of public keys so that certificate chains through eight compromised eMudhra intermediates are rejected (reported as CERT_REVOKED), and updates the bundled root store to NSS 3.131.1.
• End-of-life lines such as 25.x and 20.x receive no fix. The project's pre-announcement, per the Node.js advisory, said releases would arrive "on or shortly after" 21 October.

What happened

The Node.js security advisory lists ten vulnerabilities. Four are high severity:

• CVE-2026-111497, Brotli decoder. An out-of-bounds write in the Brotli decoder bundled with Node.js, which the advisory says permits remote code execution. It affects 26.x, 24.x and 22.x. The advisory gives no exploit details. The release notes show the fix is a cherry-pick of an upstream Brotli change (deps: brotli: cherry-pick 0ed4268a4401abcb44720963), and Node.js also exposes a new error constant, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH.
• CVE-2026-105482, dns.resolve. Names containing a NUL character are truncated at that character. The fix makes dns.resolve* reject such input. It affects 26.x, 24.x and 22.x.
• CVE-2026-105483, TLS hostname bypass with fullwidth digits. A TLS certificate hostname bypass when the IP address is written using fullwidth digits. It affects 26.x and 24.x. The release notes title the fix "tls: fix ip normalization regression".
• CVE-2026-106069, TLS hostname bypass with loosely resolved hosts. A bypass when a host only "loosely resolves" to an IP address. It affects 26.x, 24.x and 22.x. The fix rejects non-canonical IP addresses.

Three medium issues cover a keep-alive socket that processes a response written before the request was sent (CVE-2026-105481), certificate validation for non-canonical IPv4 hostnames in which a DNS name entry can authenticate an IP endpoint (CVE-2026-106072), and crypto.randomUUID() and randomInt() entropy caches that get saved into user-land startup snapshots and single executable applications, so every process repeats the same values (CVE-2026-106074).

Three low issues affect the Permission Model and ZIP handling: a ZIP header problem (CVE-2026-106070) and a wildcard filesystem over-grant (CVE-2026-106071), both affecting 26.x only, and a Permission Model bypass through fs.realpathSync (CVE-2026-106073), which affects all three lines.

Alongside the fixes the three releases update bundled dependencies. According to the release notes, all three update c-ares to 1.34.9 and Undici (to 8.12.2 on 26.x, 7.30.1 on 24.x and 6.29.1 on 22.x); the 24.x and 22.x lines move to OpenSSL 3.5.9, and 22.x also updates SQLite to 3.53.4.

Background

This is not the first large Node.js security batch this year. On 18 June 2026 the project shipped fixes for 12 vulnerabilities across the same three lines, according to GBHackers, including a WebCrypto denial-of-service flaw and a TLS wildcard authentication bypass. The recurring theme is hostname and certificate handling: the June release fixed a Unicode dot-separator problem in TLS wildcard matching, and two of this week's high-severity fixes concern IP-address spellings that Node.js's TLS check and the operating system's resolver interpret differently.

That mismatch is the core of the TLS bugs. Node.js verifies a server's certificate against the name you connected to. IPv4 addresses can be written many ways: 127.1, a hex form, a single integer, a leading-zero form or fullwidth digits. According to an independent hands-on write-up by the blogger Ikesan, net.isIP() does not treat these as IP addresses, but URL normalisation turns them into addresses, and the operating system's resolver may connect to an address. Before the fix, a certificate carrying an IP-shaped name such as DNS:127.0.0.1 could pass the check for a connection to 127.1. The author reproduced this on the pre-fix 24.22.0 and found it rejected on 24.22.1. An attacker would still need such a certificate issued by an authority the client trusts, which limits practical exploitation. The fix commit for CVE-2026-105483, as quoted by the same author, says the bug is not easy to exploit.

The eMudhra change connects to the certificate-authority incident that came to light this week. We reported that eMudhra's eight compromised intermediate certificates are being blocked by Mozilla, Google and Apple, after researchers showed the intermediates' private keys had only 255 possible values. Cloudflare's write-up has the technical detail. Node.js ships Mozilla's root store but, as the commit message explains in the hands-on write-up, has no equivalent of Chrome's CRLSet or Firefox's OneCRL and does not check revocation online by default. Rather than remove roots, which would break legitimate certificates, the project now compiles in SHA-256 hashes of blocked public keys and reports a match as CERT_REVOKED. The hands-on author says Go and Electron ship the same list.

The numbers

The advisory counts ten fixes. Four are high, which makes this release more serious than its low and medium tail suggests, though we found no reports of exploitation in the wild.

High4

Medium3

Low3

Node.js 21 October 2026 security fixes by severity (CVEs)

	CVEs
High	4
Medium	3
Low	3

Source: Node.js security advisory, 21 October 2026

Not every line is equally exposed. Of the ten CVEs, seven are marked as affecting all of 26.x, 24.x and 22.x; CVE-2026-105483 affects 26.x and 24.x; CVE-2026-106070 and CVE-2026-106071 affect 26.x only.

What it means

For anyone running Node.js servers. Upgrade to 26.12.1, 24.22.1 or 22.23.4. The Brotli flaw matters most because of how often the decoder is reached. The independent write-up notes that Node's fetch() decompresses responses automatically when the Content-Encoding header contains br, so a malicious server can trigger the decoder even if your code never calls the zlib Brotli functions, and sending Accept-Encoding: identity does not prevent it. That is the reading of undici 7.30.1 by one researcher, not a statement from the Node.js project, but it explains why server-side code that fetches third-party URLs deserves priority. The write-up also says that passing the fix commit's invalid data to the decoder produced an error on both patched and unpatched builds, so a quick test cannot confirm whether a build is exposed; upgrading is the reliable check.

For apps that take hostnames from users. If your code resolves or connects to names that come from input (webhooks, link previews, proxies), the DNS and TLS fixes close two ways in which the name that was checked differs from the name that was used. Until you upgrade, the write-up suggests refusing names that contain \0 and rejecting hosts for which net.isIP() is false but net.isIP(url.domainToASCII(host)) is not.

For container users. Rebuilding from a cached image can leave a floating tag on the old version. The independent author reports that on release day the Docker Hub tags node:24.22.1, node:22.23.4 and node:26.12.1 had been pushed, while Homebrew still lagged. Pull before you rebuild, or pin the version.

For those on end-of-life lines. Node.js says end-of-life versions are always affected when a security release occurs. Version 25 is listed as end of life on the release page, so it gets no fix. The release schedule on the Node.js site shows 22 and 24 as LTS and 26 as Current.

What we don't know yet

• The advisory gives no technical detail on how CVE-2026-111497 can be exploited, what conditions are needed for code execution, or whether a public proof of concept exists. We have not found reports of exploitation.
• It does not say who maintains the eMudhra blocklist going forward or how new entries will be added.
• We have not independently tested the patched builds; the behaviour described above comes from the Node.js release notes and the third-party write-up.

What to watch next

• Exploit write-ups or proofs of concept for the Brotli flaw, which usually follow once distributors ship fixes.
• Updated Docker official images, distribution packages and cloud runtimes (AWS Lambda, Azure Functions, Vercel and others). Check which Node.js version your platform actually runs.
• The next scheduled Node.js security release, and further blocklist entries as the eMudhra investigation continues.

Update, 24 October 2026

The same Brotli decoder flaw, CVE-2026-111497, has since been confirmed in the Python packages. GitHub's advisory GHSA-9v8h-qqgm-4m35, published on 22 October, covers brotli from 1.0.3 up to but not including 1.2.1 and brotlicffi up to but not including 1.2.1.0, and rates it Critical (CVSS v4 9.2). Fixed versions are brotli 1.2.1 and brotlicffi 1.2.1.0.

Aikido, which first called the bug Node2Shell, renamed it HTTP2Shell on 23 October because libraries and applications that handle HTTP are exposed through Brotli decompression. It lists fixes for Bun (1.4.4), Envoy (1.40.0, 1.39.3, 1.38.6, 1.37.8) and Istio (1.29.9, 1.30.6, 1.31.2), and says pip-audit, Dependabot and Safety did not yet flag the vulnerable PyPI versions, so check pip show Brotli brotlicffi by hand. As a stopgap, reject Content-Encoding: br at the proxy before decoding. Aikido reports no exploitation in the wild as of 22 October, citing The Hacker News.

Source: GitHub Advisory Database

Update, 24 October 2026

Aikido published a write-up of the Brotli flaw (CVE-2026-111497) on 23 October, updated on 24 October, that extends the picture beyond Node.js. It lists fixed versions for the upstream Google Brotli library (1.0.10, 1.1.1 and 1.2.1), the Python brotli package (1.2.1) and brotlicffi (1.2.1.0), Bun (1.4.4), Envoy and Istio. It also says that Python HTTP clients such as urllib3/requests, httpx with the brotli extra, aiohttp and Scrapy load Brotli automatically when it is installed, and that as of 23 October pip-audit, Dependabot and Safety did not yet flag the vulnerable Python packages. The GitHub advisory for the Python packages (GHSA-9v8h-qqgm-4m35) rates the flaw Critical, CVSS v4 9.2.

Imperva's Red Team separately demonstrated code execution on an unmodified Node.js 24.22.0 Linux arm64 image, through responses read with fetch() and through request bodies handled by Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0. Node.js 24.22.1 rejected the same inputs. Imperva says execution did not succeed on every attempt and reports no exploitation in the wild; Aikido, citing The Hacker News, also reports none for Node.js as of 22 October.

If you cannot upgrade, Aikido suggests rejecting Content-Encoding: br on inbound requests before decoding, rejecting br responses on outbound calls, and, for Python, uninstalling Brotli and brotlicffi.

Source: Aikido

Update, 26 October 2026

Since our original report, the Brotli flaw (CVE-2026-111497) has turned out to reach well beyond Node.js.

Microsoft shipped out-of-band .NET fixes. According to BleepingComputer, Microsoft published an advisory on Sunday 25 October and released .NET 8.0.33, 9.0.22 and 10.0.14, with .NET 11 Release Candidate 3. Brotli decompression is off by default in .NET; apps are exposed only if they enable ASP.NET Core request decompression, HttpClient automatic response decompression, or call the System.IO.Compression Brotli APIs. Microsoft says that on systems with non-default configurations the bug can also be used to escalate privileges remotely.

Python and other ecosystems. The fix is in Google Brotli 1.0.10, 1.1.1 and 1.2.1 (released 21 October), and in the Python packages Brotli 1.2.1 and brotlicffi 1.2.1.0. urllib3, requests, httpx and aiohttp can reach the bug when a vulnerable Brotli is installed: run pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0".

Exploit status. Public proof-of-concept code has been published, and the Imperva Red Team demonstrated code execution on the official Node.js 24.22.0 container image, according to the tracking page broccoli2shell.com. BleepingComputer and that page report no confirmed attacks in the wild so far. The flaw has picked up the nicknames "HTTP2Shell", "Broccoli2Shell" and "Node2Shell", though it is not specific to HTTP/2.

What to do beyond the Node.js upgrade. Updating your operating system's Brotli package does not fix Node.js or applications that bundle their own copy. Restart processes and rebuild container images. Blocking incoming Content-Encoding: br requests at a proxy helps with the server-side route but not with your own code fetching a malicious compressed response. We could not verify from project release notes the tracker's claim that some projects (it names DuckDB and Apache Arrow) still bundle unpatched copies, so audit your own vendored copies.

Source: BleepingComputer: Microsoft releases emergency .NET patches for critical Brotli flaw

Sources

• Node.js: Wednesday, October 21, 2026 Security Releases (primary)
• Node.js 26.12.1 release notes, 24.22.1, 22.23.4
• Ikesan: Node.js v24.22.1 fixes four HIGH CVEs, tested against v24.22.0 and EOL v25.3.0
• GBHackers: Node.js Releases Security Updates for 12 Vulnerabilities (June 2026)
• Cloudflare: eMudhra certificate compromise