Node.js Fixes 10 Flaws, Including a Brotli Bug That Could Allow Remote Code Execution

Node.js released security updates on 21 October for all three supported release lines, fixing ten vulnerabilities. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that Node.js bundles, which the project says can allow remote code execution.

The fixed versions are 26.12.1, 24.22.1 and 22.23.4. Node.js 20 and older are end of life and will not receive fixes.

The Brotli bug

Brotli is a compression format widely used on the web. Node.js runs its bundled Brotli decoder whenever code decompresses Brotli data, either directly through the node:zlib module or automatically when fetch() receives a Brotli-compressed response. Malformed compressed input can make the decoder write past the end of its buffer.

An application is exposed when it decompresses Brotli data that an attacker controls. That can be a request body sent to the application, or a response from another server that the application fetches. The second case is easy to overlook: a service that calls out to third-party APIs or fetches user-supplied URLs can be reached through the responses it receives.

The flaw was reported by OpenAI's Codex Security team. A public proof of concept published on 22 October achieved code execution only against a deliberately weakened test build; on a standard build its author reported a crash and a limited read of process memory. No exploitation in the wild had been reported as of 22 October.

The same fix shipped upstream in Brotli 1.2.1, 1.1.1 and 1.0.10, so other software that bundles Brotli may need updating too. Vercel added firewall rules on 21 October that block the attack in incoming requests, but they do not cover responses an application fetches, and Node.js documents no workaround besides upgrading.

The other nine

Three more flaws are rated high:

• CVE-2026-106069 and CVE-2026-105483: two ways to bypass TLS certificate hostname checks when the target is an IP address written in an unusual form.
• CVE-2026-105482: dns.resolve truncates names that contain a NUL character.

The medium-rated fixes cover keep-alive socket handling, certificate validation for non-canonical IPv4 hostnames, and a flaw in which crypto.randomUUID() and randomInt() produce the same values in every process started from the same startup snapshot or single-executable application. Three low-rated fixes cover ZIP header handling and two bypasses of the experimental Permission Model.

Compromised certificates blocked

The release also updates Node.js's bundled certificate authority store, which the project lists under the eMudhra intermediate CA compromise disclosed this week, and moves to NSS 3.131.1, the release of Mozilla's certificate library that removes the affected eMudhra root. Node.js applications use their own bundled list of trusted certificates rather than the browser's, so they do not benefit from the blocks that Chrome, Firefox, Apple and Microsoft pushed to browsers. Our report on the eMudhra compromise.

Bundled dependencies were also updated: undici, c-ares, OpenSSL on the 22.x and 24.x lines, and SQLite on 22.x.

What to do

1. Upgrade to 26.12.1, 24.22.1 or 22.23.4, depending on your line, and restart running services.
2. Rebuild container images so they pick up the new Node.js version, rather than waiting for the next scheduled build.
3. Move anything still on Node.js 20 or older to a supported line. It will not get these fixes.
4. Check other software that bundles Brotli for vendor updates.