Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including a Brotli remote code execution flaw and TLS hostname bypasses

The Node.js project shipped security releases on 21 October 2026 for its three supported lines: 26.12.1, 24.22.1 and 22.23.4. Between them they fix ten CVEs, four rated high, including a flaw in the bundled Brotli decoder that the project says "permits remote code execution", two TLS hostname-verification bypasses and a DNS bug that lets a name be silently cut short. The release also blocks certificate chains through the eight compromised eMudhra intermediate certificates, a problem we covered earlier this week. Anyone running Node.js in production, or shipping it inside a container image, should plan an upgrade today.

Key points

• Node.js 26.12.1 (Current), 24.22.1 (LTS) and 22.23.4 (LTS) were released on 21 October 2026 and fix ten CVEs: four high, three medium and three low.
• The high-severity issues are CVE-2026-111497 (out-of-bounds write in the Brotli decoder, which the project says permits remote code execution), CVE-2026-105482 (dns.resolve truncates names containing a NUL character), and TLS hostname-verification bypasses CVE-2026-105483 and CVE-2026-106069.
• CVE-2026-111497, CVE-2026-105482 and CVE-2026-106069 affect all three lines; CVE-2026-105483 affects 26.x and 24.x only.
• The release adds a blocklist of public keys so that certificate chains through eight compromised eMudhra intermediates are rejected (reported as CERT_REVOKED), and updates the bundled root store to NSS 3.131.1.
• End-of-life lines such as 25.x and 20.x receive no fix. The project's pre-announcement, per the Node.js advisory, said releases would arrive "on or shortly after" 21 October.

What happened

The Node.js security advisory lists ten vulnerabilities. Four are high severity:

• CVE-2026-111497, Brotli decoder. An out-of-bounds write in the Brotli decoder bundled with Node.js, which the advisory says permits remote code execution. It affects 26.x, 24.x and 22.x. The advisory gives no exploit details. The release notes show the fix is a cherry-pick of an upstream Brotli change (deps: brotli: cherry-pick 0ed4268a4401abcb44720963), and Node.js also exposes a new error constant, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH.
• CVE-2026-105482, dns.resolve. Names containing a NUL character are truncated at that character. The fix makes dns.resolve* reject such input. It affects 26.x, 24.x and 22.x.
• CVE-2026-105483, TLS hostname bypass with fullwidth digits. A TLS certificate hostname bypass when the IP address is written using fullwidth digits. It affects 26.x and 24.x. The release notes title the fix "tls: fix ip normalization regression".
• CVE-2026-106069, TLS hostname bypass with loosely resolved hosts. A bypass when a host only "loosely resolves" to an IP address. It affects 26.x, 24.x and 22.x. The fix rejects non-canonical IP addresses.

Three medium issues cover a keep-alive socket that processes a response written before the request was sent (CVE-2026-105481), certificate validation for non-canonical IPv4 hostnames in which a DNS name entry can authenticate an IP endpoint (CVE-2026-106072), and crypto.randomUUID() and randomInt() entropy caches that get saved into user-land startup snapshots and single executable applications, so every process repeats the same values (CVE-2026-106074).

Three low issues affect the Permission Model and ZIP handling: a ZIP header problem (CVE-2026-106070) and a wildcard filesystem over-grant (CVE-2026-106071), both affecting 26.x only, and a Permission Model bypass through fs.realpathSync (CVE-2026-106073), which affects all three lines.

Alongside the fixes the three releases update bundled dependencies. According to the release notes, all three update c-ares to 1.34.9 and Undici (to 8.12.2 on 26.x, 7.30.1 on 24.x and 6.29.1 on 22.x); the 24.x and 22.x lines move to OpenSSL 3.5.9, and 22.x also updates SQLite to 3.53.4.

Background

This is not the first large Node.js security batch this year. On 18 June 2026 the project shipped fixes for 12 vulnerabilities across the same three lines, according to GBHackers, including a WebCrypto denial-of-service flaw and a TLS wildcard authentication bypass. The recurring theme is hostname and certificate handling: the June release fixed a Unicode dot-separator problem in TLS wildcard matching, and two of this week's high-severity fixes concern IP-address spellings that Node.js's TLS check and the operating system's resolver interpret differently.

That mismatch is the core of the TLS bugs. Node.js verifies a server's certificate against the name you connected to. IPv4 addresses can be written many ways: 127.1, a hex form, a single integer, a leading-zero form or fullwidth digits. According to an independent hands-on write-up by the blogger Ikesan, net.isIP() does not treat these as IP addresses, but URL normalisation turns them into addresses, and the operating system's resolver may connect to an address. Before the fix, a certificate carrying an IP-shaped name such as DNS:127.0.0.1 could pass the check for a connection to 127.1. The author reproduced this on the pre-fix 24.22.0 and found it rejected on 24.22.1. An attacker would still need such a certificate issued by an authority the client trusts, which limits practical exploitation. The fix commit for CVE-2026-105483, as quoted by the same author, says the bug is not easy to exploit.

The eMudhra change connects to the certificate-authority incident that came to light this week. We reported that eMudhra's eight compromised intermediate certificates are being blocked by Mozilla, Google and Apple, after researchers showed the intermediates' private keys had only 255 possible values. Cloudflare's write-up has the technical detail. Node.js ships Mozilla's root store but, as the commit message explains in the hands-on write-up, has no equivalent of Chrome's CRLSet or Firefox's OneCRL and does not check revocation online by default. Rather than remove roots, which would break legitimate certificates, the project now compiles in SHA-256 hashes of blocked public keys and reports a match as CERT_REVOKED. The hands-on author says Go and Electron ship the same list.

The numbers

The advisory counts ten fixes. Four are high, which makes this release more serious than its low and medium tail suggests, though we found no reports of exploitation in the wild.

High4

Medium3

Low3

Node.js 21 October 2026 security fixes by severity (CVEs)

	CVEs
High	4
Medium	3
Low	3

Source: Node.js security advisory, 21 October 2026

Not every line is equally exposed. Of the ten CVEs, seven are marked as affecting all of 26.x, 24.x and 22.x; CVE-2026-105483 affects 26.x and 24.x; CVE-2026-106070 and CVE-2026-106071 affect 26.x only.

What it means

For anyone running Node.js servers. Upgrade to 26.12.1, 24.22.1 or 22.23.4. The Brotli flaw matters most because of how often the decoder is reached. The independent write-up notes that Node's fetch() decompresses responses automatically when the Content-Encoding header contains br, so a malicious server can trigger the decoder even if your code never calls the zlib Brotli functions, and sending Accept-Encoding: identity does not prevent it. That is the reading of undici 7.30.1 by one researcher, not a statement from the Node.js project, but it explains why server-side code that fetches third-party URLs deserves priority. The write-up also says that passing the fix commit's invalid data to the decoder produced an error on both patched and unpatched builds, so a quick test cannot confirm whether a build is exposed; upgrading is the reliable check.

For apps that take hostnames from users. If your code resolves or connects to names that come from input (webhooks, link previews, proxies), the DNS and TLS fixes close two ways in which the name that was checked differs from the name that was used. Until you upgrade, the write-up suggests refusing names that contain \0 and rejecting hosts for which net.isIP() is false but net.isIP(url.domainToASCII(host)) is not.

For container users. Rebuilding from a cached image can leave a floating tag on the old version. The independent author reports that on release day the Docker Hub tags node:24.22.1, node:22.23.4 and node:26.12.1 had been pushed, while Homebrew still lagged. Pull before you rebuild, or pin the version.

For those on end-of-life lines. Node.js says end-of-life versions are always affected when a security release occurs. Version 25 is listed as end of life on the release page, so it gets no fix. The release schedule on the Node.js site shows 22 and 24 as LTS and 26 as Current.

What we don't know yet

• The advisory gives no technical detail on how CVE-2026-111497 can be exploited, what conditions are needed for code execution, or whether a public proof of concept exists. We have not found reports of exploitation.
• It does not say who maintains the eMudhra blocklist going forward or how new entries will be added.
• We have not independently tested the patched builds; the behaviour described above comes from the Node.js release notes and the third-party write-up.

What to watch next

• Exploit write-ups or proofs of concept for the Brotli flaw, which usually follow once distributors ship fixes.
• Updated Docker official images, distribution packages and cloud runtimes (AWS Lambda, Azure Functions, Vercel and others). Check which Node.js version your platform actually runs.
• The next scheduled Node.js security release, and further blocklist entries as the eMudhra investigation continues.

Sources

• Node.js: Wednesday, October 21, 2026 Security Releases (primary)
• Node.js 26.12.1 release notes, 24.22.1, 22.23.4
• Ikesan: Node.js v24.22.1 fixes four HIGH CVEs, tested against v24.22.0 and EOL v25.3.0
• GBHackers: Node.js Releases Security Updates for 12 Vulnerabilities (June 2026)
• Cloudflare: eMudhra certificate compromise