Node.js Patches 10 Flaws, Including Brotli Decoder Bug the Project Says Allows Remote Code Execution

Node.js released security updates on October 21 for its three supported release lines, fixing 10 vulnerabilities. The patched versions are 22.23.4, 24.22.1 and 26.12.1.

The headline flaw is CVE-2026-111497, an out-of-bounds write in the Brotli decompression code that Node.js bundles. The project's advisory says the bug permits remote code execution. Node.js rates it high, not critical.

How the Brotli bug works

Brotli is Google's compression library. Node.js ships its own copy and runs it whenever it decompresses Brotli data. That happens directly through the node:zlib module, or automatically when code calls fetch() on a response sent with Brotli compression.

Specially crafted, malformed input can make the decoder write past the end of its buffer. An application is exposed where it decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server.

The fix is an upstream patch from the Brotli project, copied into Node.js. It makes the decoder catch invalid input and stop early. The same change shipped in Brotli 1.2.1, 1.1.1 and 1.0.10 on October 21. It was first committed to Brotli's source in February 2026, roughly eight months before the security releases.

The advisory credits a developer going by mcollina with reporting the flaw and aduh95 with the fix. It lists no workarounds. Upgrading is the remediation.

What the proof-of-concept shows

A public proof-of-concept appeared today, October 22. Its author reached code execution only against a deliberately weakened test build. On a standard Node.js build, the author reported a crash and a limited read of process memory, and said a working attack on a normal build was not achieved.

That sits against the project's own wording. Node.js describes the impact as potentially allowing remote code execution, and the advisory does not spell out detailed exploitation prerequisites. No exploitation in the wild has been reported as of October 22. Patched Node.js rejects the malformed input the proof-of-concept uses.

The other high-severity fixes

Three more flaws are rated high:

• CVE-2026-106069: a TLS certificate check that an attacker could bypass by writing a server's IP address in an unusual form, so a certificate matches a host it should not. It affects all three lines.
• CVE-2026-105483: a hostname verification bypass using an IP address written in full-width digits. It affects 26.x and 24.x. Node.js rates it high, though the commit that fixed it calls the bug low-severity and hard to exploit.
• CVE-2026-105482: dns.resolve truncates a hostname at an embedded null byte. It affects all three lines.

Medium and low-severity fixes

Three medium flaws affect all three lines. CVE-2026-105481 lets a keep-alive socket process a response written before its request was sent. CVE-2026-106072 is improper certificate validation for nonstandard IPv4 hostnames, allowing DNS certificate names to authenticate IP endpoints.

CVE-2026-106074 makes crypto.randomUUID() and crypto.randomInt() return the same values in every process when an application is built as a startup snapshot or a single-executable application. That undermines anything relying on those values being unpredictable.

The three low-severity flaws are CVE-2026-106070 (attacker-controlled bytes returned after failed ZIP header checks, 26.x), CVE-2026-106071 (excessive filesystem access through wildcard matching, 26.x) and CVE-2026-106073 (a Permission Model bypass through fs.realpathSync, all three lines).

The releases also update c-ares, Undici and the CA certificate list. The certificate update adds a built-in block for eight intermediate CA keys from the Indian provider eMudhra, which had been reported compromised days earlier. Node.js relies on the Mozilla root list and does not run revocation checks by default, so before this update a chain built on one of those keys could still validate. The bundled root list also drops three emSign roots.

Who is left exposed

Node.js 20.x and earlier have reached end of life and will not receive any of these fixes. The project advises moving to a supported line.

Official nodejs.org binaries and the official Docker images are decided by version number. Distribution packages are different. Atlas, a security publication, noted that Alpine, Fedora and CentOS Stream packages of Node link against the system Brotli library, so the fix has to arrive through the distro's own package. As of 3:45 PM CDT on October 21, Atlas found no listing for the CVE in the Debian, Ubuntu or Red Hat trackers or in the NVD. Alpine's edge branch was shipping Node 24.18.1 when Atlas checked.

Single-executable applications and bundled runtimes ignore the system install entirely. For those, the version baked into the build decides exposure, and third-party vendors have to say what they ship.

Bun is not covered by this CVE, but Atlas reported that it builds its own copy of Brotli pinned to v1.2.0, which predates the fix. Atlas said Bun's decoder source matches the unpatched code in Node 24.22.0, and that Bun's fetch() uses it to decode Brotli responses. Atlas said it has not tested Bun's exposure. As of Atlas's check, the latest release was Bun 1.4.3 from October 10, Bun had published no advisory, and a community pull request proposing the fix (#46351) had drawn no maintainer response.

What remains open is how quickly distro maintainers and Bun's team move. Until they do, a matching version number from node -v on a distro-packaged install does not prove the Brotli decoder is fixed.