On October 21, 2026, Node.js released security updates v26.12.1, v24.22.1, and v22.23.4, addressing ten vulnerabilities: four high, three medium, and three low. End-of-life versions are also affected. The advisory lists no workarounds and does not mention exploitation in the wild. The releases also update bundled dependencies, including the CA certificates after the eMudhra intermediate CA compromise.
CVE-2026-111497 is the most severe issue and the only one with potential for remote code execution. A flaw in the bundled Brotli decoder allows crafted compressed data to overflow an internal buffer during decompression, potentially causing crashes, memory disclosure, or code execution with the privileges of the Node.js process. Applications decompressing untrusted Brotli data through `node:zlib` are exposed. All three supported release lines are affected.
The other three high-severity vulnerabilities affect DNS resolution and TLS certificate validation. CVE-2026-105482 allows NUL-byte truncation in `dns.resolve` and `dns.reverse`, potentially causing applications to validate one hostname while resolving another. CVE-2026-105483 and CVE-2026-106069 allow TLS certificate validation bypasses through non-canonical IP representations, including fullwidth digits and leading-zero IPv4 addresses. A related medium-severity issue, CVE-2026-106072, allows numeric DNS certificate entries to incorrectly authenticate IP endpoints.
The remaining medium and low severity issues involve HTTP keep-alive response handling (CVE-2026-105481), cryptographic entropy reuse in startup snapshots (CVE-2026-106074), improper ZIP header validation (CVE-2026-106070), and two filesystem Permission Model bypasses (CVE-2026-106071 and CVE-2026-106073). Several issues are incomplete fixes for previously patched vulnerabilities.
Detections (10)
Enable detections →Connect your environment for suggestions and queries personalized to your security telemetry.
- Node.js Server Compromise via Shell Commands
- Node.js Server Running Discovery Commands
- Node.js Server Compromise via Dropped Binary
- PowerShell Reconnaissance Spawned by Node.js
- Shell Reverse Connection via Dev TCP Redirection
- Named Pipe Reverse Shell via mkfifo
- Netcat or Socat Listener with Command Execution
- Scripting Interpreter Reverse Shell
- Node Runtime Initiating WinRM Connections To Multiple Internal Hosts
