Node.js Fixes 10 Vulnerabilities (CVE-2026-111497 and More): A Technical Summary for Engineers on the October 21, 2026 Security Release

Node.js has vulnerabilities too. On October 21, 2026, the Node.js project published a security release that fixes 10 vulnerabilities: 4 rated High, 3 Medium and 3 Low (Node.js official blog). The fixed versions are 22.23.4, 24.22.1 and 26.12.1. This is a separate matter from the PHP “PHP2Shell” vulnerabilities.

This article is written for engineers who run Node.js. It is built around primary sources, such as the Node.js official blog, the release notes (24.22.1, 22.23.4) and the CVE record, and it separates what is confirmed from what is not. Sources are cited next to each statement. The information is current as of October 22, 2026.

Key points

• The fixed versions are 22.23.4 (LTS), 24.22.1 (LTS) and 26.12.1 (Current) (official blog).
• The most serious issue is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that is described as able to lead to remote code execution (RCE). The root cause is in Google’s Brotli library itself (CVE record).
• Three issues let an attacker bypass TLS hostname verification (2 High, 1 Medium). All involve non-canonical notations of IP addresses (official blog).
• 20.x and 25.x are end-of-life and get no fixed version. The project states that EOL versions are always considered affected when a security release ships (official blog).
• The official blog lists no workaround. Updating is the fix.
• The official blog says nothing about exploitation. As of October 22, I found no reports of attacks in the wild, within what I was able to check.

Affected versions

Status of each release line, based on the official release schedule (the schedule.json file in nodejs/Release).

24.x moved from Active LTS to Maintenance LTS on October 20. Maintenance is the phase in which only critical bug fixes and security fixes land. 26.x is scheduled to become LTS on October 28.

The 10 vulnerabilities

The Node.js official blog does not describe the cause or attack conditions of each issue in detail. It gives the title, the affected lines, the reporter and the fixer. The “What the fix does” column in the table below comes from the titles of the fix commits listed in the 24.22.1 and 22.23.4 release notes.

Node.js has not published CVSS scores for these CVEs (official blog). Of the four CVE records I tried to check as of October 22 (CVE-2026-111497, 105482, 105483 and 106069), I could retrieve only CVE-2026-111497 on cve.org.

CVE-2026-111497: the Brotli decoder

The title on the Node.js official blog is “an out-of-bounds write in the Brotli decoder allows remote code execution.” According to the CVE record, the cause is not Node.js itself but Google’s google/brotli library.

• Affected Brotli: 1.0.3 up to but not including 1.0.10, 1.1.0 up to but not including 1.1.1, and 1.2.0 up to but not including 1.2.1
• Fixed Brotli: 1.0.10, 1.1.1 and 1.2.1 (listed on GitHub releases, dated October 21)
• What happens: a crafted Brotli compressed stream can corrupt adjacent decoder state memory, which can result in leaking sensitive memory, denial of service or arbitrary code execution
• Authentication: not required (a remote, unauthenticated attacker)
• CVSS: 9.2 (CRITICAL) under v4.0. This is the rating from Google, the CNA that assigned the CVE. The Node.js blog rates it High

The Node.js fix pulls in this Brotli fix (24.22.1 release notes). The reporter is listed as OpenAI Codex Security (official blog).

As for what is affected, the Vercel bulletin explains it this way: a Node.js process is affected when it decompresses attacker-controlled Brotli data, either as a request body or as a fetched response. Node.js does not decompress Brotli data on its own initiative. The official blog does not say which specific APIs are involved.

My own view: places worth checking include Brotli decompression in zlib (such as zlib.brotliDecompress), middleware that decompresses requests sent with Content-Encoding: br, and any code that decompresses Brotli-compressed responses fetched from external APIs.

Vercel states that researchers demonstrated process memory disclosure and command execution against unpatched versions (Vercel bulletin). It does not mention any exploitation in the wild.

Brotli is embedded in far more than Node.js. Because the flaw is in the library itself, other products that use Brotli, such as browsers, HTTP clients, web server modules and language bindings, each need their own update check. As of October 22, google/brotli’s GitHub security advisories page had no published advisories.

TLS hostname verification bypasses (3 issues)

CVE-2026-105483, CVE-2026-106069 and CVE-2026-106072 are all cases where TLS certificate hostname verification does not behave as expected around “non-canonical” IP address notations, such as full-width digits or strings that are loosely parsed as IP addresses. The fixed versions now reject non-canonical IP addresses in TLS (release notes).

My own view: if your configuration or environment variables write destination IP addresses in an unusual notation, connections may be refused after the update. Always test outbound connections after updating.

The rest

• CVE-2026-105482 (High): dns.resolve truncates names that contain NUL characters and resolves the shortened name. The fix validates input for NUL bytes (release notes)
• CVE-2026-105481 (Medium): a keep-alive socket processes a response that was written before the request was sent
• CVE-2026-106074 (Medium): the random caches behind randomUUID() and randomInt() are stored in user snapshots and in SEAs (single executable applications). As a result, every process started from the same snapshot repeats the same values
• CVE-2026-106070, 106071 and 106073 (Low): these concern ZIP handling and the Permission Model (--permission). If you use the Permission Model, check them

Dependency updates

The release also updates dependencies. According to the 24.22.1 release notes:

In 22.23.4, undici is 6.29.1 and SQLite is 3.53.4, and the rest are the same. The official blog lists “ca-cert (eMudhra Intermediate CA Compromise)” under dependency updates. The root certificate store was updated in response to an issue involving an eMudhra intermediate certificate authority. The Node.js blog does not give details on this, though. For details, check announcements from the certificate authority and the browser vendors.

How to update

First, check which version you actually run in production, in CI and in containers.

node -v

An example with nvm:

nvm install 24.22.1    # 22.23.4 for the 22 line, 26.12.1 for the 26 line
nvm use 24.22.1

For Docker, pull the base image again, rebuild without the cache and check the version inside the container.

docker build --pull --no-cache -t myapp .
docker run --rm myapp node -v

Rebuilding the container is also described in an explainer on ToolScope (a secondary source, in Japanese). I could not confirm when the official Docker images (nodejs/docker-node) were published, so pull again and verify with node -v. If you pin the version in .nvmrc, the engines field of package.json, setup-node in CI and so on, update those too.

If you use snapshots or SEAs, rebuild them with a fixed runtime. The official blog does not mention rebuilding. Still, a random cache that was already saved would likely remain unless you rebuild (my own view).

Frameworks that run on Node.js

Vercel

According to the Vercel bulletin, on October 21 Vercel rolled out a WAF rule for this vulnerability to all projects and applied it automatically. It does not cover traffic that does not pass through Vercel’s network, or responses a function fetches from an external server. Vercel is moving its managed runtimes to the fixed versions. What you need to do on your side:

• For Node.js running outside Vercel’s managed runtimes, update to 22.23.4, 24.22.1 or 26.12.1, with or without the WAF
• If a project uses Node.js 20.x, switch to 22.x or 24.x and redeploy (20.x cannot receive the fix)
• For your own container images, rebuild from a fixed base image and redeploy
• For self-hosted Next.js, update Node.js

A separate Next.js update (not a Node.js vulnerability)

Separately from the Node.js update, Next.js published an out-of-band security update on October 14. The fixed versions are 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). It fixes 2 Critical issues and 1 High issue.

• Unauthenticated RCE when use cache returns a typed array (Critical, GHSA-673q-mjm6-r5xr). There is no workaround, so you need to update
• Unauthenticated RCE when the image optimization API handles SVG (Critical, CVE-2026-96889, GHSA-2464-fhr4-w9xw). This affects apps running on glibc-based Linux. As a workaround, you can move sharp to 0.35.5 or later
• Denial of service in the App Router with Server Actions (High, GHSA-p3m5-59mp-jv5r)

If you use Next.js, check both the Node.js update and the Next.js update.

Exploitation status and how reliable the information is

The absence of attack reports is not proof of safety. Brotli is used well beyond Node.js, so a wide check is needed.

Release changes that affect your update planning

The Node.js release plan is changing too. According to the official announcement “Evolving the Node.js Release Schedule,” starting with Node.js 27 there will be one major release a year, in April, promoted to LTS in October. The odd and even distinction goes away, and every release becomes LTS. The LTS period is 30 months. The project gives the maintenance burden as one reason, saying it had become hard to maintain security releases across four or five lines.

In schedule.json, 27.x Alpha starts October 28, and 27.0.0 is planned for April 22, 2027. 26.x is the last release under the old model.

The practical decisions that follow from this incident:

• If you are on 20.x or 25.x, there is no fixed version, so you need to migrate
• 22.x reaches EOL on April 30, 2027. 24.x is already in Maintenance, with EOL on April 30, 2028 (schedule.json)
• For long-term use, 26.x, which becomes LTS on October 28, has the longest support period (EOL on April 30, 2029)

Where to start

Today

1. Check which Node.js version you run in production, CI and containers
2. If you are on 20.x or 25.x, plan a migration to 22.x, 24.x or 26.x
3. Update to 22.23.4, 24.22.1 or 26.12.1
4. List the places that handle Brotli (request body decompression, decompression of results fetched from external APIs)

This week

5. Pull container images again, rebuild and redeploy
6. Rebuild snapshots and SEAs with the fixed runtime
7. Check whether you write destination IP addresses in an unusual notation, and test outbound connections
8. If you use Next.js, confirm you are on 16.4.1 or 15.5.28

This quarter

9. Decide your Node.js policy (use LTS only, and settle who updates it and how often)
10. If you use the Permission Model, check the impact of the three issues in this release