Node.js has rolled out crucial security updates for its 22.x, 24.x, and 26.x release lines on October 21, patching a total of ten vulnerabilities. The most significant of these is a high-severity out-of-bounds write flaw within the bundled **Brotli** decompression code, which the project indicates could lead to remote code execution (RCE). ### Urgent Updates for Supported Node.js Versions Developers are strongly advised to update to the latest patched versions: **22.23.4**, **24.22.1**, and **26.12.1**. Users of **Node.js 20.x** and earlier versions, which have reached end-of-life, will not receive these fixes and must migrate to a supported release line to ensure security. ### The Critical Brotli Vulnerability (**CVE-2026-111497**) The **Brotli** flaw, identified as an out-of-bounds write, is triggered by malformed compressed input. This vulnerability exists in the code Node.js bundles, not in user-developed applications directly. It can be exploited whenever Node.js decompresses **Brotli** data, either explicitly via the `node:zlib` module or automatically when `fetch()` is used on a **Brotli**-compressed response. An application becomes vulnerable if it decompresses **Brotli** data controlled by an attacker, such as within a request body or a response from an external server.  The fix for this flaw originates from an upstream patch by the **Brotli** project, which now enables the decoder to detect and halt processing of invalid input earlier, preventing buffer overflows. **Google's Brotli** library itself received this fix in versions **1.2.1**, **1.1.1**, and **1.0.10** on October 21, suggesting other software bundling **Brotli** may also require updates. While Node.js describes the flaw as allowing remote code execution and rates it as high severity, public proof-of-concept exploits have, so far, only achieved RCE against deliberately weakened test builds. On standard Node.js configurations, these PoCs have reportedly caused crashes and limited memory reads, but not full code execution. As of October 22, no in-the-wild exploitation of this vulnerability has been reported. ### Other High-Severity Vulnerabilities Beyond the **Brotli** flaw, three other high-severity issues were addressed: * **CVE-2026-106069** and **CVE-2026-105483**: Two **TLS** certificate bypass vulnerabilities where an attacker could use unusual IP address formats to trick **TLS** into matching a certificate to an incorrect host. * **CVE-2026-105482**: A flaw in `dns.resolve` that caused hostnames containing an embedded null byte to be truncated. ### Medium and Low-Severity Fixes Several medium and low-severity flaws were also patched. Notably, **CVE-2026-106074** addresses an issue where `crypto.randomUUID()` and `crypto.randomInt()` could return identical values across processes when an application is built as a startup snapshot or a single-executable application, compromising the unpredictability of these functions. Here's a comprehensive list of all vulnerabilities addressed: | CVE | What it is | Severity | Affected lines | | :--------------- | :------------------------------------------------------------------------------------------------------- | :------- | :-------------------- | | **CVE-2026-111497** | Out-of-bounds write in the Brotli decoder; remote code execution, per the project | High | 22.x, 24.x, 26.x | | **CVE-2026-106069** | TLS hostname-check bypass when a host resolves to an IP address in non-canonical form | High | 22.x, 24.x, 26.x | | **CVE-2026-105483** | TLS hostname-check bypass when an IP is written in fullwidth digits | High | 24.x, 26.x | | **CVE-2026-105482** | dns.resolve truncates names that contain a null byte | High | 22.x, 24.x, 26.x | | **CVE-2026-105481** | Keep-alive socket can process a response written before the request was sent | Medium | 22.x, 24.x, 26.x | | **CVE-2026-106072** | Certificate validation for non-canonical IPv4 lets DNS names authenticate IP endpoints | Medium | 22.x, 24.x, 26.x | | **CVE-2026-106074** | randomUUID() and randomInt() caches reused in startup snapshots and single-executable apps | Medium | 22.x, 24.x, 26.x | | **CVE-2026-106070** | ZipFile returns attacker-controlled bytes after a failed header check | Low | 26.x | | **CVE-2026-106071** | Permission Model over-grants file access through a wildcard lookup | Low | 26.x | | **CVE-2026-106073** | Permission Model bypass with fs.realpathSync | Low | 22.x, 24.x, 26.x | ### eMudhra Certificate Block Implemented The updates also address the recent compromise of eight intermediate certificate authority keys from the Indian provider **eMudhra**. Node.js now includes a built-in block for these compromised keys and updates its bundled root list to remove three **emSign** roots. This move mirrors an emergency update by **Go** on October 20, reinforcing the industry's response to the compromise. It's important to note that connections established before the update will not be re-checked until their session expires, and end-of-life Node.js versions will not receive this critical certificate block. ### Dependency Updates and Workarounds Beyond the specific CVEs, the updates include refreshes for several bundled components. The **undici** HTTP client, which powers `fetch()`, has been updated to fix three moderate advisories related to its **Subresource Integrity** check and two memory-exhaustion flaws, one affecting the **WebSocket** client. Additionally, Node.js updated its bundled **c-ares** across all lines, **OpenSSL** on 22.x and 24.x, and **SQLite** on 22.x, incorporating fixes for known vulnerabilities in these dependencies. **Upgrading immediately is the primary and recommended fix.** The advisory does not offer temporary workarounds for the **Brotli** flaw within Node.js itself. While services like **Vercel** have implemented firewall rules to block inbound attacks leveraging the **Brotli** flaw, these measures do not cover **Brotli** responses fetched by an application from other servers and are not a substitute for upgrading your Node.js installations.