Node.js Patches 10 Vulnerabilities, Including a Critical Brotli RCE Bug

Quick answer: Node.js shipped a security release on October 21, 2026 fixing 10 vulnerabilities, 4 of them rated high severity. The most serious is a memory-corruption bug in Node's Brotli decompression handling, reported to permit remote code execution. The fixed versions are 22.23.4, 24.22.1, and 26.12.1. Node.js 20 and older don't get a fix, since that line reached end-of-life back on April 30, 2026. No workaround has been published for any of the 10 issues, so upgrading is the only real fix.

Every detail in this post is verified directly against Node.js's own advisory at nodejs.org/en/blog/vulnerability/october-2026-security-releases.

Ten vulnerabilities in one release isn't unusual for Node.js, security releases land on a regular cadence throughout the year. What makes this one worth a closer look is the nature of the worst bug: it sits in a decompression routine, which means it's reachable from untrusted input your server receives, not from something an attacker needs local access to trigger.

What Got Fixed

The release covers all three currently supported Node.js lines:

• Node.js 22 → patched in 22.23.4
• Node.js 24 → patched in 24.22.1
• Node.js 26 → patched in 26.12.1

Of the 10 vulnerabilities, 4 are rated high severity, 3 medium, and 3 low. The release also bumps several components Node.js bundles from other projects, including OpenSSL, c-ares, SQLite, and Undici, which is normal practice: a Node security release often rolls up fixes from its dependencies alongside fixes to Node's own code. It also ships an updated ca-cert bundle tied to a compromised eMudhra intermediate certificate authority, unrelated to the other bugs but worth knowing if anything in your stack pins Node's bundled CA list.

Every Vulnerability in This Release

Three of these deserve a closer look beyond the headline Brotli bug.

The Most Serious Bug: Brotli Decompression Memory Corruption

The headline issue, CVE-2026-111497, is an out-of-bounds write in how Node.js decompresses Brotli-encoded data, severe enough to permit remote code execution. Brotli is a compression format used widely for HTTP content encoding, meaning the vulnerable code path can be reached by data your server receives and decompresses as part of normal request handling, not just by code you control. It was reported by OpenAI Codex Security (credited to Khai Tran and Sylvie Mayer) and fixed by Node.js contributors mcollina and aduh95.

That's the detail that moves this from "patch when convenient" to "patch promptly": a decompression bug reachable from network input is a materially different risk than a bug that needs an attacker to already be running code on the machine.

Two TLS Hostname Checks Can Be Bypassed

CVE-2026-105483 and CVE-2026-106069 are both High severity and both let an attacker get around Node's hostname verification during a TLS handshake, one by writing an IP address using fullwidth digit characters, the other by using a hostname that loosely resolves to an IP. In plain terms: software that checks "does this certificate actually belong to the host I think I'm connecting to" can be tricked into saying yes when it shouldn't. That matters for anything in your stack that makes outbound TLS connections and relies on Node's own hostname validation rather than a separate check.

A Quieter Bug Worth Knowing: Repeated "Random" Values

CVE-2026-106074 is easy to miss next to an RCE headline, but it's genuinely unusual: crypto.randomUUID() and randomInt() cache entropy that can get baked into a startup snapshot or a single executable application (SEA). Any process launched from that same snapshot then repeats the same "random" values instead of generating fresh ones. If you use either function to generate identifiers you assume are unique or unpredictable, and you build snapshots or SEAs as part of your deployment, this is worth checking specifically rather than assuming the version bump alone covers it.

Why There's No Workaround

For most of the 10 fixed vulnerabilities, including the Brotli bug, no mitigation or workaround has been published. That means disabling a feature, changing a config flag, or adding a WAF rule isn't a substitute here. The only way to close the gap is to run a patched Node.js version.

Node.js 20 and Older Are Not Covered

If you're still running Node.js 20 or earlier, this release doesn't apply to you, not because you're safe, but because that line stopped receiving security patches entirely after reaching end-of-life on April 30, 2026. Any vulnerability found in Node 20 after that date, including this one, simply won't be fixed upstream. Running an end-of-life runtime in production means accepting that any future Node security release, including releases far more serious than this one, will never reach you unless you upgrade to a supported line first.

What To Actually Do About It

• Check which Node.js version your production services actually run, not what your package.json engines field says you intend to support, what's actually deployed.
• If you're on Node 22, 24, or 26, upgrade to 22.23.4, 24.22.1, or 26.12.1 respectively.
• If you're on Node 20 or older, the real fix is migrating to a supported major version, not just taking the latest patch within an unsupported line, because there isn't one.
• Re-deploy and confirm the running version in production, a merged dependency bump isn't the same as a redeployed service.
• Check any Docker base images, CI runners, or build pipelines that pin a specific Node.js version, those need the same update independently of your application code.

Final Thoughts

A Node.js security release with a remotely reachable memory-corruption bug and no workaround is about as clear-cut a "patch now" signal as this kind of advisory gets. The harder part usually isn't the patch itself, it's knowing which of your services are still running an affected version, and whether any of them have quietly drifted onto an end-of-life line that won't get a fix at all.

That inventory problem is the real work here. The patch takes minutes. Finding every place you need to apply it is what actually takes the care.