Node.js released security updates for all three of its supported lines on Wednesday 21 October, fixing 10 vulnerabilities. The most serious is a flaw in its Brotli decoder that the project says can allow remote code execution.
The versions to install are v26.12.1 for the 26.x line, v24.22.1 for 24.x and v22.23.4 for 22.x, according to the Node.js advisory.
Of the 10 flaws, four are rated high, three medium and three low. “The highest severity issue fixed in this release is HIGH,” the project said. The advisory gives no CVSS scores.
The Brotli Bug
The advisory lists the headline flaw as “Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497)”. It is rated high and affects the 26.x, 24.x and 22.x lines. It was reported by OpenAI Codex Security (Khai Tran and Sylvie Mayer).
The Brotli code ships bundled inside Node.js. According to The Hacker News, Node.js runs it in two situations: when it decompresses Brotli data through node:zlib, and when fetch() receives a Brotli-compressed response. An app is exposed where it decompresses Brotli data that an attacker controls.
High, Not Critical
The rating matters. The flaw is rated high, not critical.
A proof of concept published on 22 October reached code execution only against a deliberately weakened test build, The Hacker News reported. On a standard build, its author reported a crash and a limited memory read, not code execution. No exploitation in the wild had been reported as of 22 October.
The problem is not confined to Node.js. The same fix shipped in Brotli 1.2.1, 1.1.1 and 1.0.10 on 21 October, so other software that bundles Brotli may need it too, The Hacker News reported.
The Other Fixes
The three other high-rated fixes cover two TLS certificate hostname bypasses (CVE-2026-105483 and CVE-2026-106069) and a dns.resolve flaw that truncates names containing a NUL character (CVE-2026-105482), the Node.js advisory says.
One medium-rated flaw, CVE-2026-106074, makes crypto.randomUUID() and randomInt() repeat the same values in every process when an app is built as a startup snapshot or a single executable application, according to the advisory.
The releases also update bundled dependencies: c-ares, ca-cert and Undici on all three lines, OpenSSL on 24.x and 22.x, and SQLite on 22.x.
The ca-cert change follows the compromise of an eMudhra intermediate certificate authority. The update blocks eight compromised eMudhra intermediate CA keys, The Hacker News reported. Node.js does not do revocation checks by default, so before this update such certificate chains still passed.
German outlet heise online also counts four high-severity fixes and advises updating to 22.23.4, 24.22.1 or 26.12.1.
Upgrade Is the Only Fix
There is no temporary workaround for the Brotli flaw, and upgrading is the fix, according to The Hacker News. Vercel added firewall rules on 21 October for inbound requests, but those rules do not cover Brotli responses that an app fetches itself.
Older lines are left out. Node.js 20.x and earlier are end of life and will not receive the fix, The Hacker News reported. The project’s advisory makes the same point in general terms.
“It’s important to note that End-of-Life versions are always affected when a security release occurs,” the Node.js project said.
For a business whose website or app runs on Node.js, the question for its developer or host is which line it uses and whether that line is now on v26.12.1, v24.22.1 or v22.23.4.
More coverage is in our Technology archive.
Sources: Node.js, “Wednesday, October 21, 2026 Security Releases”, 21 October 2026 (https://nodejs.org/en/blog/vulnerability/october-2026-security-releases); The Hacker News, “Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions”, 22 October 2026 (https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html); heise online, “Node.js-Update bessert hochriskante Lücken aus”, 21 October 2026 (https://www.heise.de/news/Node-js-fixt-eigene-und-geerbte-Sicherheitsluecken-11495996.html)
Illustration: this image was generated by AI and is not a photograph of any real software, server or system.
One new board set into a sun-bleached coastal boardwalk, the repair still pale against the old timber. Standing in for a software patch, this scene shows no real Node.js system.
Illustration: AI-generated for WRP.
