Node.js patches high-severity Brotli RCE flaw (CVE-2026-111497) across 22.x, 24.x and 26.x
Kyrannio · x · 2026-10-22
Node.js has shipped its October 21, 2026 security releases for the 22.x, 24.x and 26.x lines, fixing several vulnerabilities.
- Most severe: an out-of-bounds write in the bundled Brotli decoder (CVE-2026-111497, high) that lets attackers supplying malicious Brotli-compressed data corrupt memory and achieve remote code execution.
- Other high-severity fixes: dns.resolve truncating names containing NUL chars (CVE-2026-105482) and two TLS certificate hostname bypasses — fullwidth-digit IPs (CVE-2026-105483) and hosts loosely resolving to IPs (CVE-2026-106069).
- The release also updates c-ares, OpenSSL, SQLite and Undici, and fixes a medium keep-alive socket issue (CVE-2026-105481).
- Fixed versions: 22.23.4, 24.22.1, 26.12.1; end-of-life versions get no updates, so admins should upgrade and restart affected services.
More from Safety
- Sentry CEO asks GitHub for granular 'revoke unused OAuth apps' option — zeeg · 2026-10-22
- Meta's Private Processing lets WhatsApp AI handle messages no one can read — kingslyj · 2026-10-22
- The internet broke today: eMudhra '4' key, PHP 9.2 RCE, GitLab 10.0 and 7 more security incidents in one day — RSync25 · 2026-10-22
- CA private key was literally '4': eMudhra's AI-generated incident report slammed for dodging the real question — evilsocket · 2026-10-22
- CVE-2026-111943: Compromised intermediate certificate authority discovered — keks24 · 2026-10-22
- Wiz says Gemini 4 Argon helped find decade-old critical vulnerability, coordinated fix across industry — HaydnBelfield · 2026-10-22