Node.js Patches Remote Code Execution Flaw and Nine Other Security Issues

The Node.js Project published security updates on October 21, 2026, for its 26.x, 24.x, and 22.x release lines. These patches resolve ten distinct vulnerabilities, including a high-severity remote code execution flaw. Organizations relying on these versions must apply the updates to mitigate exposure to the identified risks.

The risk

The most significant issue, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder. This flaw allows for remote code execution and affects all three supported release lines. Developer mcollina reported the vulnerability, while aduh95 implemented the correction. The project does not specify prerequisites for exploitation or confirm active abuse in the wild.

Three other high-severity issues relate to hostname handling. CVE-2026-105482 causes DNS resolution to truncate names containing NUL characters. CVE-2026-105483 allows bypassing TLS certificate hostname checks when an IP address uses full-width digits. CVE-2026-106069 impacts hosts that loosely resolve to IP addresses. These weaknesses could potentially undermine trust in network connections.

Additional vulnerabilities include CVE-2026-106074, which affects entropy caches in crypto.randomUUID() and randomInt(). In specific configurations like user-land startup snapshots, this can cause processes to repeat the same values. The release also updates c-ares, Undici, and CA certificates to address the eMudhra Intermediate CA compromise.

Who is exposed

Applications running Node.js versions prior to 26.12.1, 24.22.1, or 22.23.4 are affected. The impact varies by branch, so teams must check their specific version against the advisory. While the Brotli decoder flaw affects all three lines, other vulnerabilities may only apply to certain branches. Version-specific assessment is required to determine the full scope of risk for each deployment.

Cost and compliance

The source material does not provide information on financial costs, regulatory penalties, or specific compliance frameworks impacted by these vulnerabilities. Organizations should consult their own security policies and risk registers to determine how these flaws affect their compliance obligations. No data on breach costs or legal consequences is available in the current reports.

What happens next

Teams should inventory their Node.js deployments and identify those running the affected versions. Prioritize patching systems that process untrusted compressed data or handle external network connections. Verify that the updated versions are correctly installed and functioning before decommissioning the vulnerable builds.

Questions to ask your suppliers

Ask vendors whether their hosted services or SaaS platforms rely on Node.js and if they have applied the latest security patches. Determine if their architecture isolates workloads to prevent a single vulnerability from impacting multiple tenants. Identify who in their organization is responsible for monitoring security advisories and communicating updates. Check whether their incident response plan includes steps for rapid remediation of underlying runtime dependencies.

What to do and how to stay safe: Node.js

• Audit your inventory to find all instances of Node.js versions 26.x, 24.x, and 22.x that are below the patched versions.
• Apply the security updates for Node.js 26.12.1, 24.22.1, and 22.23.4 to your development, staging, and production environments.
• Monitor logs for unusual activity in DNS resolution, TLS connections, or Brotli decoding processes that might indicate exploitation attempts.
• Review your third-party service contracts to confirm suppliers have updated their Node.js dependencies and can provide proof of patching.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Node.js versions are affected by the remote code execution flaw?

Node.js versions 26.x, 24.x, and 22.x prior to the specific security updates are affected by CVE-2026-111497.

Is the Brotli decoder vulnerability actively being exploited?

The advisory does not provide evidence of active exploitation or detailed prerequisites for the attack.

What other components were updated in this release?

The release includes updates to c-ares, Undici, CA certificates, OpenSSL, and SQLite across the affected branches.