Node.js Patches Ten Vulnerabilities, Including High-Severity TLS, DNS, and Brotli Flaws
Node.js has released security updates for its 26.x, 24.x, and 22.x branches, addressing ten vulnerabilities, four of which are rated high severity.
Node.js has issued critical security updates across its 26.x, 24.x, and 22.x software branches, patching a total of ten vulnerabilities. The releases, scheduled for October 21, 2026, include four high-severity flaws that could impact TLS certificate verification, DNS name resolution, and Brotli decompression processes. The patched versions are 26.12.1, 24.22.1, and 22.23.4.
The most severe of these vulnerabilities, CVE-2026-111497, resides within the Brotli decoder. This flaw is described as an out-of-bounds write that could permit remote code execution if an application processes untrusted Brotli-compressed content. While the exact exploitation conditions are not detailed in the advisory, this vulnerability poses a significant risk to systems handling such data.
Two high-severity vulnerabilities (CVE-2026-105483 and CVE-2026-106069) affect the Transport Layer Security (TLS) certificate hostname verification process. CVE-2026-105483 specifically targets Node.js versions 26.x and 24.x, allowing a bypass when IP addresses use full-width digits. CVE-2026-106069, affecting all three supported branches, deals with hostnames that loosely resolve to an IP address. Both issues raise concerns about attackers potentially impersonating legitimate servers by presenting certificates that do not strictly match the intended destination.
Another high-severity vulnerability, CVE-2026-105482, impacts the dns.resolve function. This flaw allows for the truncation of DNS names that contain a NUL character, potentially leading to inconsistent name handling and security issues for applications relying on accurate DNS resolution before establishing connections.
In addition to the critical flaws, the update addresses three medium-severity vulnerabilities. These include an HTTP request-response ordering flaw (CVE-2026-105481), improper TLS certificate hostname validation for nonstandard IPv4 hostnames (CVE-2026-106072), and issues with repeated cryptographic random values in cached data (CVE-2026-106074). Two low-severity vulnerabilities were also patched, one related to ZIP header validation (CVE-2026-106070) and another concerning filesystem permission bypasses (CVE-2026-106073, CVE-2026-106071).
These patches are part of Node.js's ongoing commitment to security, following previous updates that addressed TLS authentication bypasses and other vulnerabilities. The release notes also indicate updates to several underlying components, including c-ares, CA certificates, Undici, OpenSSL, and SQLite, with varying branch coverage.
Administrators are strongly advised to deploy the appropriate patched versions of Node.js immediately. This includes rebuilding application images where necessary and restarting affected services. Thorough testing of outbound HTTPS connections, DNS handling, compressed content processing, and permission-restricted workloads is recommended. Users should consult the official Node.js security announcement for detailed information and ensure they are running supported versions, as end-of-life branches will not receive further security fixes.