Node.js October 2026 Security Release: Brotli RCE + 9 CVEs

TL;DR

• Node.js released security updates on October 21, 2026, for the 26.x, 24.x, and 22.x branches.
• The release fixes 10 CVEs across the core engine and bundled dependencies (c-ares, OpenSSL, SQLite, Undici, and the eMudhra CA certificate).
• The most serious is CVE-2026-111497, a high-severity out-of-bounds write in the Brotli decoder that allows remote code execution against any Node.js application accepting Brotli-encoded input.
• Three High-severity TLS and DNS flaws (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) enable certificate hostname bypasses and SSRF defence evasion.
• Patched versions are v26.12.1, v24.22.1, and v22.23.4. Upgrade immediately.
• Node.js 20.x and earlier are end-of-life and will not receive patches. Migrate to a supported branch.
• No in-the-wild exploitation has been reported yet, but the Brotli RCE and TLS bypasses make the window short

On October 21, 2026, the Node.js Project released coordinated security updates for every active release line (26.x, 24.x, and 22.x) to address 10 CVEs ranging from Low to High severity. The highest-impact issue is a Brotli decoder out-of-bounds write that permits remote code execution (CVE-2026-111497), alongside three High-severity flaws in TLS certificate hostname validation and DNS name handling. 

The release also ships dependency updates for c-ares, OpenSSL (24.x, 22.x), SQLite (22.x), Undici, and a CA certificate update covering the eMudhra Intermediate CA compromise. Every merchant, platform operator, and application owner running Node.js in production should treat this release as mandatory and patch within the next deployment window.

Patched Vulnerabilities

High-severity CVEs

CVE-2026-111497: Brotli decoder out-of-bounds write (26.x, 24.x, 22.x). The highest-impact flaw in this release. An out-of-bounds write in Node.js’s bundled Brotli decoder permits remote code execution when attacker-controlled Brotli-encoded data is decompressed. Any Node.js application that accepts Brotli-encoded input over the network (HTTP request bodies with Content-Encoding: br, fetch() responses from a hostile server, websocket frames with Brotli compression) is on the attack surface. Reported by mcollina and fixed by aduh95.

CVE-2026-105482: dns.resolve truncates names containing NUL char (26.x, 24.x, 22.x). The dns.resolve API silently truncates hostnames containing NUL bytes. An attacker who controls part of a hostname passed to DNS resolution can inject a NUL byte to make Node.js resolve a different name than the application intended, which breaks SSRF defences and allowlist-based URL filtering. Reported by hasanfleyah and fixed by jasnell.

CVE-2026-105483: TLS certificate hostname bypass when the IP is written in fullwidth digits (26.x, 24.x). Node.js’s TLS hostname verification treats fullwidth Unicode digits (U+FF10 to U+FF19) differently from ASCII digits during IP comparison. An attacker with a valid certificate for one IP can present it as valid for another IP written in fullwidth digits, defeating hostname pinning. Reported by hasanfleyah and fixed by jasnell.

CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP (26.x, 24.x, 22.x). TLS hostname validation accepts certificates where the host string loosely resolves to an IP address, enabling cross-host impersonation. Reported by anagnorisis2peripeteia and fixed by mcollina.

Medium-severity CVEs

CVE-2026-105481: Keep-alive socket processes a response that was written before the request was sent (26.x, 24.x, 22.x). A race condition in HTTP keep-alive handling can cause a client to associate a response with the wrong request on a reused connection. The impact is HTTP response smuggling or request/response desynchronisation, which can lead to cache poisoning, auth bypass, or cross-user data leakage in proxied setups.

CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames (26.x, 24.x, 22.x). DNS Subject Alternative Names (SANs) can be used to authenticate IP endpoints when the IPv4 hostname is written in a non-canonical form (octal, hex, mixed-notation), bypassing intended certificate scoping.

CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches persist into startup snapshots and SEAs (26.x, 24.x, 22.x). The entropy caches for crypto.randomUUID() and randomInt() are saved into user-land startup snapshots and Single Executable Applications (SEAs). Every process launched from the snapshot replays the same “random” values. For applications using these APIs to generate session tokens, nonces, or encryption salts in SEA-packaged binaries, the result is catastrophic predictability of values the application assumed were random.

Low-severity CVEs

CVE-2026-106070: ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation (26.x). Zip file parsing returns attacker-controlled data when header validation fails, enabling partial content disclosure.

CVE-2026-106071: Permission Model filesystem over-grant via wildcard radix lookup (26.x). The Node.js Permission Model (--permission flag) grants broader filesystem access than requested when wildcard patterns are evaluated through the radix tree lookup.

CVE-2026-106073: Permission Model bypass with fs.realpathSync (26.x, 24.x, 22.x). fs.realpathSync can be used to escape Permission Model filesystem boundaries by resolving symbolic links outside the allowed path set.

Bundled dependency updates

Every patched release ships updated versions of c-ares (26.x, 24.x, 22.x) and Undici (26.x, 24.x, 22.x), with OpenSSL updated on 24.x and 22.x and SQLite on 22.x. The release also delivers a CA certificate store update that revokes trust for the eMudhra Intermediate CA, which was compromised and removed from the Mozilla CA store earlier in 2026.

Which Node.js versions are affected

Every Node.js installation running an active release line (26.x, 24.x, 22.x) prior to the October 21 release is affected by at least one of these CVEs. End-of-life Node.js versions (20.x and earlier) are affected and will not receive patches.

Containerised deployments built on node:* base images from before October 21 are affected. SEA-packaged binaries built on vulnerable versions are affected (CVE-2026-106074 is particularly dangerous for SEA deployments).

Managed Node.js runtimes on serverless platforms (AWS Lambda, Vercel, Netlify, Cloudflare Workers’ Node compatibility layer) are affected and are being patched by each vendor on their own timelines.

How to Fix

Upgrade to the patched release for your branch:

• 26.x → v26.12.1
• 24.x LTS → v24.22.1
• 22.x LTS → v22.23.4

Rebuild container images from the updated node:* tags and redeploy. For SEA-packaged applications, rebuild the SEA with the patched Node.js binary. For managed runtimes, confirm your platform vendor has rolled the patch into their execution environment before considering the migration complete. Verify the installed version on every host with node --version and compare against the patched release.

Workaround

The core upgrade is the only complete fix. Interim mitigations for environments that cannot patch immediately:

• For CVE-2026-111497 (Brotli RCE): disable Brotli decompression at the application or reverse proxy layer, and strip Content-Encoding: br headers from untrusted inbound traffic.
• For CVE-2026-105482 (DNS NUL truncation): validate hostnames passed to dns.resolve for NUL bytes before resolution.
• For CVE-2026-105483, CVE-2026-106069 and CVE-2026-106072 (TLS hostname bypasses): tighten certificate pinning using exact-match SPKI or certificate fingerprints rather than hostname-based verification for sensitive connections.
• For CVE-2026-105481 (keep-alive desync): disable HTTP keep-alive on sensitive upstreams, or terminate keep-alive at a reverse proxy you trust.
• For CVE-2026-106074 (SEA entropy cache): avoid baking SEAs on vulnerable Node.js versions. For existing SEA deployments, regenerate every secret the SEA has produced since its last rebuild.
• For Permission Model bypasses: do not rely on --permission as a security boundary on vulnerable versions.

Every mitigation above is strictly interim.

Conclusion

10 CVEs in a single Node.js security release is on the heavier end of a typical quarterly cadence. The Brotli RCE and the 3 TLS hostname bypasses are the 4 that will drive active exploitation research first. The SEA entropy cache bug is the one most likely to produce silent, undetected compromise in production because the vulnerable randomness looks legitimate until an attacker proves it is not.

Patch today, rotate secrets produced on vulnerable SEAs, and audit any TLS pinning logic that depends on Node.js’s built-in hostname verification.

If you run Node.js in production and want an independent read on how exposed your stack is to the October 2026 release, schedule a call with Astra.