The Node.js project released security updates on October 21 for its three supported release lines, fixing 10 vulnerabilities. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decompression code that Node.js bundles. The project describes it as permitting remote code execution (an attacker running code of their choosing on the affected system) and rates it high. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20.x and earlier have reached end of life and will not receive the fix.
According to The Hacker News, an application is exposed where it decompresses Brotli data that an attacker controls, either directly through the node:zlib module or automatically when code uses fetch() on a response sent with Brotli compression. The same outlet reports that a public proof of concept published on October 22 reached code execution only against a deliberately weakened test build; on a standard build its author reported a crash and a limited read of process memory, and no exploitation in the wild had been reported as of October 22. Three other flaws are also rated high: two TLS hostname-check bypasses involving unusual ways of writing an IP address (CVE-2026-106069 and CVE-2026-105483) and a dns.resolve bug that cuts a hostname short at a null byte (CVE-2026-105482). The release also updates the bundled certificate list to address the eMudhra intermediate CA compromise we covered yesterday.
How to check if you’re affected
Affected versions are Node.js 22.x, 24.x and 26.x releases older than 22.23.4, 24.22.1 and 26.12.1, and every Node.js release from the end-of-life 20.x line and earlier.
- Run
node --versionon each server, build machine and container image. Check the Node.js inside Docker base images too, since they carry their own copy. - Move to the fixed version for your line. If you are on 20.x or older, you need to move to a supported line, because no patch will be issued for it.
- Not every flaw touches every line: CVE-2026-105483 affects 24.x and 26.x only, and the ZipFile issue (CVE-2026-106070) affects 26.x only. The Node.js notice lists the lines for each CVE.
- The Brotli fix also shipped upstream in Brotli 1.2.1, 1.1.1 and 1.0.10, so other products that bundle their own Brotli copy may need an update from their vendor.