Node.js Releases Security Updates to Fix High-Severity TLS, DNS and Brotli Vulnerabilities

Node.js Security Updates 🚀

Node.js has released security updates for its 26.x, 24.x, and 22.x branches to address ten vulnerabilities, including four high-severity flaws affecting DNS lookups, TLS certificate checks, and Brotli decompression. The supplied release details identify 26.12.1, 24.22.1, and 22.23.4 as the patched versions. The most serious potential outcome is remote code execution through the Brotli decoder.

The October security update also covers:

• HTTP connection handling
• Repeated random values
• ZIP processing
• Filesystem permission checks

Node.js scheduled the releases for October 21, 2026, and listed high severity as the highest risk across all three supported branches.

Vulnerabilities Overview 🔍

• CVE-2026-111497 affects the Brotli decoder in all three release lines. The advisory describes an out-of-bounds write that permits remote code execution, meaning the decoder can write outside its intended memory area. Applications that process untrusted Brotli-compressed content should receive particular attention during patch planning.

• Two high-severity vulnerabilities involve TLS certificate hostname checks:
  • CVE-2026-105483 allows a hostname verification bypass when an IP address uses full-width digits, affecting Node.js 26.x and 24.x.
  • CVE-2026-106069 involves hostnames that loosely resolve to an IP address and affects all three branches.
• The fourth high-severity issue, CVE-2026-105482, causes dns.resolve to truncate names containing a NUL character, affecting all three release lines.

Medium and Low Severity Issues ⚠️

Three medium-severity issues broaden the update’s scope:

• CVE-2026-105481 allows a keep-alive socket to process a response written before its request was sent.
• CVE-2026-106072 concerns improper certificate validation for nonstandard IPv4 hostnames, allowing DNS certificate names to authenticate IP endpoints.
• CVE-2026-106074 affects cached random data stored in startup snapshots and single executable applications.

All three medium-severity flaws affect the 26.x, 24.x, and 22.x branches. The remaining issues carry low ratings.

Recommendations ✅

Administrators should deploy the matching patched release, rebuild application images where needed, and restart affected services. Testing should cover outbound HTTPS connections, DNS handling, compressed content, and permission-restricted workloads. The project warns that end-of-life branches remain affected even after security releases, so migrating to a supported branch is an important part of remediation.

For more details, Read full article.