Node.js ships security updates fixing 4 high-severity bugs, incl. Brotli RCE
jedisct1 · x · 2026-10-21
Node.js released security updates for 26.x, 24.x and 22.x fixing four high-severity issues: dns.resolve truncating names containing NUL chars (CVE-2026-105482), a TLS certificate hostname bypass via fullwidth-digit IPs (CVE-2026-105483, 26.x/24.x), a hostname bypass when the host loosely resolves to an IP (CVE-2026-106069), and an out-of-bounds write in the Brotli decoder enabling remote code execution (CVE-2026-111497), plus one medium keep-alive socket bug. Dependency updates cover c-ares, ca-cert (eMudhra Intermediate CA compromise), OpenSSL, SQLite and Undici.
More from Safety
- OpenAI and Apollo Research find o3 can detect when it's being safety-tested — alex_verem · 2026-10-22
- eMudhra root certificate leak could enable MITM attacks; researchers urge browser and app updates — birchlse · 2026-10-22
- Wiz used Gemini 4 and GPT-5.6 to uncover critical PHP RCE chain — basedjensen · 2026-10-22
- echudhra.com: one-line curl/node/docker commands to test if your tools trust the leaked eMudhra keys — SuB8u · 2026-10-21
- LiteLLM supply chain attack, PHP flaws found by GPT-5.6: AI is making hacking faster and cheaper — Yuchenj_UW · 2026-10-21
- php2shell credit war: @lcfr_hax confirmed as first to find and exploit the PHP bug class — basedjensen · 2026-10-21