Node.js Fixes 10 Flaws, Including a Brotli Bug That Could Allow Remote Code Execution

Node.js released security updates on 21 October for its 26.x, 24.x and 22.x lines, fixing ten vulnerabilities. Of the four it rates high, CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that Node.js bundles, which the project says can allow remote code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October and gave US federal agencies until 10 November to fix it.

The fixed versions are 26.12.1, 24.22.1 and 22.23.4. Node.js 20 reached end of life on 30 April and won't receive fixes.

The Brotli bug

Node.js runs its bundled Brotli decoder whenever code decompresses Brotli data, either directly through node:zlib or when the built-in fetch() reads a Brotli-compressed response. The Node.js advisory says malformed input makes the decoder keep appending bytes to an eight-byte internal buffer until it writes past the end. Khai Tran and Sylvie Mayer of OpenAI's Codex Security team are credited with the report.

An application is exposed when it decompresses Brotli data that an attacker controls, in a request body it accepts or in a response from a server it fetches.

On 22 October Imperva published a proof of concept that ran attacker-supplied code on the official Node.js 24.22.0 Linux arm64 image through both routes: a response read with fetch(), and a request body parsed by Express 5 with body-parser. It took several attempts, and 24.22.1 rejected the same input. Imperva notes that a bare Node.js HTTP server doesn't decode incoming Brotli bodies by itself.

The same fix shipped upstream in Brotli 1.2.1, 1.1.1 and 1.0.10; Brotli 1.0.3 to 1.2.0 are affected wherever they're bundled. Vercel added firewall rules on 21 October that block the attack in incoming requests, and says they don't cover responses an application fetches.

The other nine

Three more flaws are rated high:

• CVE-2026-106069 and CVE-2026-105483: two ways to bypass TLS certificate hostname checks when the target is an IP address written with a leading zero or in fullwidth digits.
• CVE-2026-105482: dns.resolve truncates names that contain a NUL character.

Among the medium-rated fixes, CVE-2026-106072 let a certificate carrying only a DNS name authenticate an IP address spelt as 0177.0.0.1 or 127.1. In another, crypto.randomUUID() and randomInt() returned the same values in every process started from the same startup snapshot or single-executable application. Three low-rated fixes cover ZIP header handling and two bypasses of the experimental Permission Model.

Three emSign roots removed

The release moves the bundled certificate store to NSS 3.131.1, which removes three emSign roots.

What to do

1. Upgrade to 26.12.1, 24.22.1 or 22.23.4, whichever matches your line, and restart running services.
2. Move anything still on Node.js 20 or older to a supported line.
3. Check other software that bundles Brotli for Brotli 1.2.1, 1.1.1 or 1.0.10.