Node.js fixes a Brotli remote code flaw and two TLS hostname bypasses

Node.js fixes a Brotli remote code flaw and two TLS hostname bypasses

21 October 2026: The Node.js project has released 26.12.1, 24.22.1 and 22.23.4 to fix ten vulnerabilities, four of them rated High, including CVE-2026-111497, an out-of-bounds write in the Brotli decoder that permits remote code execution, and two flaws that let a TLS certificate pass a hostname check it should fail. The project names no exploitation; every supported line needs the update, and end-of-life lines are affected without a fix.

Fixed versions

• Node.js 26: 26.12.1
• Node.js 24 (LTS): 24.22.1
• Node.js 22 (LTS): 22.23.4

The four High flaws

CVE	What goes wrong	Lines
CVE-2026-111497	Brotli decoder out-of-bounds write permits remote code execution	26, 24, 22
CVE-2026-106069	TLS hostname check passes when the host loosely resolves to an IP address	26, 24, 22
CVE-2026-105483	TLS hostname check passes when an IP is written with fullwidth digits	26, 24
CVE-2026-105482	dns.resolve truncates names containing a NUL character	26, 24, 22

The Brotli bug matters wherever a Node service decompresses data it did not produce, which includes HTTP clients accepting br-encoded responses and servers accepting compressed uploads. The two TLS bugs undermine the check that a certificate belongs to the host being contacted, the protection that stops an interception attack on outbound calls to APIs and internal services.

Medium and Low fixes worth reading

Three Medium issues stand out: a keep-alive socket that processes a response written before its request was sent (CVE-2026-105481), non-canonical IPv4 hostnames letting DNS names in a certificate authenticate an IP endpoint (CVE-2026-106072), and crypto.randomUUID() and randomInt() caches saved into startup snapshots and single executable applications, so that every process built from the same snapshot repeats the same "random" values (CVE-2026-106074). Teams that ship Node as a single executable or use startup snapshots should treat that last one as more than Medium if they use those IDs as tokens. Three Low issues touch the experimental Permission Model and ZIP handling.

Bundled dependencies and the eMudhra block

The releases also update c-ares and Undici on every line, OpenSSL on 24 and 22, and SQLite on 22, and they change the bundled CA store to deal with the compromise of eMudhra intermediate certificates. That matters because Node trusts its own bundled roots rather than the operating system's by default, so servers that never update Node keep trusting what browsers have already blocked.

Node.js 20 and older lines are not in the release and receive none of these fixes; commercial support for older lines is available through the OpenJS Foundation's partners. Some vendors have already set their own cut-off dates, such as HubSpot's developer CLI ending Node.js 20 support on 8 January 2027.

Related on TrustList:

• Next.js 16.4.1 fixes two critical flaws that need no login to exploit
• Deno joins Cloudflare: Deno Deploy shuts down in six months
• Next.js flaw in next/og ImageResponse allows remote code execution: upgrade to 16.3.6

Sources

• Node.js: Wednesday, October 21, 2026 Security Releases, 21 October 2026
• Node.js release index (v26.12.1, v24.22.1, v22.23.4), 21 October 2026
• ACN (Italy): Node.js, risolte molteplici vulnerabilità, 21 October 2026