Node.js ships security releases fixing high-severity RCE and TLS bypass flaws
mohamedmansour · x · 2026-10-22
Node.js released security updates for 26.x, 24.x and 22.x on October 21 — upgrade to v26.12.1, v24.22.1 or v22.23.4. Key fixes:
- Brotli decoder out-of-bounds write allowing RCE (CVE-2026-111497, high), affects all three lines
- dns.resolve truncating names containing NUL chars (CVE-2026-105482, high)
- Two TLS certificate hostname bypasses (CVE-2026-105483, CVE-2026-106069, high): fullwidth-digit IPs and loosely-resolving hosts
- Keep-alive socket processing a response written before the request (CVE-2026-105481, medium)
Dependency updates also cover c-ares, ca-cert (tied to the eMudhra intermediate CA compromise), OpenSSL, SQLite and Undici.
Related event: Node.js Ships Security Updates Across 22/24/26 Lines Fixing Brotli RCE(10 posts)→
More from Infra
- AWS tutorial: fleet-wide edge CV model lifecycle with SageMaker SDK v3, ~$0.07 per run — AWS ML Blog · 2026-10-27
- Qwen3.8-27B hits 40 tok/s on Jetson Thor with INT4 + MTP, accuracy beats FP16 — No-Dragonfly6246 · 2026-10-27
- Celesto launches CI runners nearly 90% cheaper than GitHub Actions, with agent sandboxes — aniketmaurya · 2026-10-27
- Supabase founders on rebuilding the backend for a billion AI-built apps — Latent Space · 2026-10-27
- AW-0 runs at 230ms on a single RTX 5090, 2.4x faster than autoregressive code planning — trevordarrell · 2026-10-27
- Site tracks US city council topics: data centers rank only behind pickleball courts — zakkohane · 2026-10-27