Do Son 
TL;DR
On October 21, 2026, the Node.js project shipped versions 22.23.4, 24.22.1 and 26.12.1 to fix 10 vulnerabilities. This Node.js security release patches four high-severity flaws, including a Brotli decoder bug that “permits remote code execution.” It also drops trust in the compromised eMudhra certificates.
Why It Matters
Node.js runs countless web servers, APIs and build tools. Three of the high-severity bugs weaken TLS hostname checks, which protect connections from impersonation. Meanwhile, the Brotli flaw could let crafted compressed data run code on a server.
How the Attacks Work
High severity
- CVE-2026-111497: an out-of-bounds write in the Brotli decoder that can lead to remote code execution.
- CVE-2026-105483 and CVE-2026-106069: TLS certificate hostname checks can be bypassed with unusual IP address formats.
- CVE-2026-105482: dns.resolve cuts off names that contain a NUL character.
Medium and low severity
Other fixes cover keep-alive response mix-ups, weak IP certificate checks and repeated random values in startup snapshots. Three low-severity bugs affect ZIP handling and the Permission Model.
eMudhra certificate cleanup
This Node.js security release also updates the bundled CA certificate store. It removes trust tied to the eMudhra intermediate CA compromise, which Mozilla, Google and Apple blocked between October 17 and 19. As a result, Node.js apps will no longer accept certificates signed by those leaked keys.
Exploitation status
The Node.js team does not report exploitation in the wild. No public proof-of-concept has been confirmed either.
Affected Versions
The flaws affect the 26.x, 24.x and 22.x release lines, though some only hit 26.x or 24.x.
Patch and Mitigation Steps
- Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1.
- Update bundled dependencies, including c-ares, OpenSSL, SQLite and Undici.
- Rebuild apps packaged as single executables or snapshots.
Full details are in the Node.js October 2026 security releases post. Given the remote code execution risk, teams should apply this Node.js security release promptly.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
