Node.js patches a Brotli decoder remote code execution flaw and nine other vulnerabilities

· CyberSecurity

TLDR

  • Node.js 22.23.4, 24.22.1 and 26.12.1 fix 10 flaws, including a Brotli decoder bug that permits remote code execution.12
  • Heise online counts four high-severity flaws, including two TLS certificate bypasses and a DNS bug; no CVSS scores are given.12
  • The releases also block the compromised eMudhra certificates; end-of-life Node.js lines receive no fix.12

The Node.js project released security updates on 21 October for the 26.x, 24.x and 22.x lines, and says the highest severity fixed is high.1 Heise online gives only qualitative ratings and lists no CVSS scores.2 The headline issue is CVE-2026-111497, an out-of-bounds write in the Node.js Brotli decoder that the advisory says permits remote code execution and that affects all three lines.13 Cyber Kendra notes the advisory does not say what input triggers the bug or whether it is reachable remotely in a default setup.3

Heise online counts four high-severity issues: the Brotli flaw, two TLS certificate verification bypasses and one DNS resolution bug.2 The TLS flaws (CVE-2026-105483 and CVE-2026-106069) involve IP addresses written in unusual forms, so a certificate issued for a domain name can be accepted for an IP endpoint, according to Cyber Kendra.3 The DNS flaw (CVE-2026-105482) makes dns.resolve truncate names containing a NUL character.13 The advisory lists six further medium and low severity fixes, including two Permission Model issues.1

The updates also deal with the eMudhra certificate authority incident: Node.js now updates its built-in certificate store to block eMudhra and adds a list of blocked intermediate certificates, so it can reject chains containing revoked keys even if the root remains trusted, heise online reports.2 Cyber Kendra says Mozilla received a report on 17 October that private keys for eight eMudhra intermediate certificates had been compromised.3 The release also updates c-ares, OpenSSL, SQLite and undici.1 Users should move to 22.23.4, 24.22.1 or 26.12.1, and the project says end-of-life versions are always affected.12

Why it matters: heise online calls the updates urgent on the eMudhra certificate block alone, and the Brotli bug adds a code execution risk across all three supported lines.12

Sources

  1. Wednesday, October 21, 2026 Security Releases (Node.js)
  2. Node.js fixes its own and inherited security vulnerabilities (heise online)
  3. Node.js Patches Brotli RCE Flaw, 9 Other Vulnerabilities (Cyber Kendra)