Node.js has issued critical updates for its 26.x, 24.x, and 22.x versions, addressing ten vulnerabilities, with four marked as high-severity. These vulnerabilities concern DNS lookups, TLS certificate verification, and Brotli decompression processes.
Updates and Vulnerability Details
The latest security patches are provided in versions 26.12.1, 24.22.1, and 22.23.4. Notably, the most severe risk involves remote code execution (RCE) through the Brotli decoder, which poses significant security threats if not promptly addressed.
Released on October 21, 2026, the updates also cover issues related to HTTP connection management, cryptographic randomness, ZIP file handling, and checks on filesystem permissions. The Node.js team underscores the urgency of addressing high-severity vulnerabilities across the supported branches.
High-Severity Vulnerabilities
Among the high-severity flaws, CVE-2026-111497 is critical, involving an out-of-bounds write that allows RCE through the Brotli decoder across all release lines. This flaw can potentially overwrite memory, leading to unpredictable application behavior.
Two other vulnerabilities, CVE-2026-105483 and CVE-2026-106069, affect TLS hostname verification processes, allowing potential bypasses. These involve discrepancies in hostname handling, impacting versions 26.x and 24.x.
Medium and Low-Severity Concerns
Medium-severity issues expand the update’s scope, including flaws in HTTP request-response ordering and improper TLS certificate validation. CVE-2026-105481 and CVE-2026-106072 are among these and affect all three primary branches.
Low-severity vulnerabilities include CVE-2026-106070, related to ZIP header validation, and CVE-2026-106071, which concerns filesystem access permissions. These require attention to prevent unauthorized data exposure and resource access.
Recommendations and Future Outlook
Administrators are advised to apply these updates immediately, rebuild application environments as necessary, and rigorously test services for HTTPS, DNS, and compression handling. Referring to the official Node.js security announcements is crucial for detailed guidance.
Organizations should prioritize migrating from unsupported Node.js versions to maintain robust security. Ensuring timely adaptation to new vulnerabilities is essential for safeguarding infrastructure against emerging threats.
