Node.js Rushes Patches for 3 Release Lines, Fixing 10 Flaws Including Remote Code ...

Node.js, the open-source JavaScript runtime, on the 21st (local time) released security updates for three release lines: 22.x, 24.x and 26.x. A total of 10 vulnerabilities were fixed in this release, of which four were rated "high" severity, three "medium" and three "low." The patched versions are 22.23.4, 24.22.1 and 26.12.1, respectively.

The most notable item is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that can be exploited for remote code execution (RCE). All three lines — 26.x, 24.x and 22.x — are affected. The official advisory, however, does not specify exploitation conditions, workarounds or evidence of active exploitation.

Three of the four "high" severity issues cluster in the areas of name resolution and certificate validation: dns.resolve truncating names containing NUL characters mid-string (CVE-2026-105482); IP addresses written in full-width digits bypassing TLS certificate hostname verification (CVE-2026-105483, affecting 26.x and 24.x); and hostnames that resolve to IP addresses evading the same verification (CVE-2026-106069).

The three "medium" severity issues are also concentrated in the communications and cryptography layers. They include responses written before a request being processed on keep-alive connections (CVE-2026-105481); weak validation of non-standard-format IPv4 addresses allowing a DNS-name SAN to authenticate an IP endpoint (CVE-2026-106072); and entropy caches for crypto.randomUUID() and randomInt() being stored in startup snapshots or SEA, causing multiple processes to generate identical values (CVE-2026-106074).

Two of the three "low" severity issues apply only to 26.x: attacker-controlled leading bytes being returned even after a ZIP header validation failure (CVE-2026-106070), and wildcard radix lookups in the permission model granting excessive filesystem permissions (CVE-2026-106071). Bypassing the permission model's access restrictions via fs.realpathSync (CVE-2026-106073) affects all lines.

Note: Seven of the 10 issues affect 26.x, 24.x and 22.x in common; the remainder vary in scope by version.

In this release, the Node.js project also refreshed dependency libraries alongside the vulnerability fixes. These include c-ares and ca-cert (tied to an intermediate certificate authority compromise), OpenSSL (24.x and 22.x), SQLite (22.x) and Undici. The project warned that end-of-life (EOL) versions are affected by every security release.

The ca-cert update is tied to the compromise of an intermediate CA operated by Indian certificate authority eMudhra. On October 17, it emerged that the private keys of eight intermediate CAs operated by eMudhra could be reconstructed from public certificates. Six were for TLS and two for code signing, and 16 certificates were revoked in total, including eMudhra's own root and cross-signed certificates from Sectigo. Chrome and Firefox blocked these CAs on the 17th, Apple on the 19th and Microsoft on the 20th. The company said roughly 30,000 certificates need to be reissued. The problem is not confined to browsers: servers using their own CA bundles, containers built from old images and embedded devices do not check revocation information and may still trust these CAs.

The support timelines for the three patched lines also warrant attention. Node.js 22 (Jod) reaches end of support on April 30, 2027, 24 (Krypton) on April 30, 2028, and 26 on April 30, 2029. Version 24 moved into maintenance mode on October 20, one day before this release, and will now receive primarily critical security fixes, while 26 transitions to LTS on October 28.

According to web technology research firm W3Techs, Node.js is a high-usage runtime, powering 7.4% of all websites with an identified web server and 9% of the top 1 million sites. With a substantial of server applications running on this runtime, certificate-validation bypasses and remote code execution flaws can extend beyond individual service outages to become broad attack paths.

On the same day, an update for PHP fixed two vulnerabilities allowing code execution without authentication, and the fallout temporarily knocked some websites offline. With security flaws surfacing simultaneously in two runtimes widely used at the web server layer, the patching burden on operations teams appears to be growing.

Security experts are paying particular attention to the TLS hostname verification bypasses among these flaws, since broken certificate validation opens the door to man-in-the-middle interception of encrypted traffic. As for the Brotli vulnerability, publicly available information is limited, so organizations should assess their actual risk by reviewing their own code paths.

In practice, organizations are advised to prioritize upgrading 26.x, 24.x and 22.x production environments to the patched versions, and — since the scope of each vulnerability differs — to set response priorities by comparing the release line in use against the features they expose. The is-my-node-vulnerable package published by the Node.js project lets users immediately check whether their installed version is exposed to known vulnerabilities; run it with npx is-my-node-vulnerable. Organizations still running end-of-life versions should also note that they are not covered by this release's protections.

GitHub repository : nodejs/is-my-node-vulnerable