# Node.js fixes 10 vulnerabilities, one with RCE in Brotli: update today

> Node.js 22.23.4, 24.22.1 and 26.12.1 fix 10 vulnerabilities, including CVE-2026-111497, a remote code execution in the Brotli decoder. What to do now.

URL: https://codegea.com/en/nodejs-october-2026-security-release-brotli-rce
Node.js · 2026-10-22 · Derian Pinto

On 21 October 2026 the Node.js project published security releases for the 22.x, 24.x and 26.x lines. They fix **10 vulnerabilities**. The most serious is **CVE-2026-111497**: an out-of-bounds write in the Brotli decoder that allows **remote code execution**.

An important nuance: the official advisory rates the worst issue as **High** severity, not "critical", and mentions no critical issue. Even so, an RCE in a library that processes network data deserves an update as soon as possible.

## Patched versions

| Line | Fixed version |
| --- | --- |
| 22.x | **22.23.4** |
| 24.x (LTS) | **24.22.1** |
| 26.x | **26.12.1** |

Versions that have already reached end of life **are also affected** and will not get a patch.

## The 10 vulnerabilities

| CVE | Severity | Lines | Summary |
| --- | --- | --- | --- |
| CVE-2026-111497 | High | 22, 24, 26 | Out-of-bounds write in the Brotli decoder that permits remote code execution |
| CVE-2026-106069 | High | 22, 24, 26 | TLS certificate hostname bypass when the host loosely resolves to an IP address |
| CVE-2026-105483 | High | 24, 26 | TLS certificate hostname bypass when the IP is written with fullwidth digits |
| CVE-2026-105482 | High | 22, 24, 26 | `dns.resolve` truncates names containing the NUL character |
| CVE-2026-105481 | Medium | 22, 24, 26 | A keep-alive socket processes a response that was written before the request was sent |
| CVE-2026-106072 | Medium | 22, 24, 26 | Improper certificate validation for non-canonical IPv4 hostnames |
| CVE-2026-106074 | Medium | 22, 24, 26 | The `crypto.randomUUID()` and `randomInt()` entropy caches are saved into startup snapshots and SEAs, so every process repeats the same values |
| CVE-2026-106070 | Low | 26 | `ZipFile` returns attacker-controlled prefix bytes after failed header validation |
| CVE-2026-106071 | Low | 26 | Permission Model filesystem over-grant |
| CVE-2026-106073 | Low | 22, 24, 26 | Permission Model bypass with `fs.realpathSync` |

The release also updates bundled dependencies: c-ares, Undici, OpenSSL (22.x and 24.x), SQLite (22.x) and a root certificate change due to the compromise of an intermediate CA (eMudhra).

## Why Brotli matters

Brotli is a compression format that web servers and APIs use routinely. Node ships it inside the binary itself, so **updating a Brotli library on your operating system is not enough: you need the new Node binary**.

According to third-party analyses of the advisory, `fetch()` and Express 5 decompress Brotli automatically, which makes the vulnerable code easier to reach when your application processes data it does not control, such as responses from external APIs. The official advisory describes the flaw in a single line, so it is best not to assume more than what has been published. No attacks have been reported so far, but the window between a patch and exploitation tends to be short.

## How to update

1. **Check your version:** `node -v` on the server and, if you use containers, the tag of your base image.
2. **nvm or fnm install:** `nvm install 24` (or the line you use) and `nvm alias default 24`.
3. **Docker:** update `FROM node:24` to a rebuilt image (`node:24.22.1`) and rebuild without cache.
4. **Managed platforms (Vercel, Railway, Render…):** confirm your project uses the latest minor version of your line; on most it is set in the project settings.
5. **Restart the processes** (PM2, systemd, containers). A running process keeps using the old binary in memory.
6. **If you use startup snapshots or SEAs** (Single Executable Applications): **regenerate them** with the new version because of CVE-2026-106074; updating the binary is not enough.
7. Run your tests and check that `npm audit` reports nothing new.

If you are still on an unsupported line (for example Node 18 or 20), take the chance to move to 24 LTS: the patch will not reach those versions.

## What else to check

- That outgoing calls always verify the TLS certificate and do not disable validation (`rejectUnauthorized: false`).
- That you do not rely on the Permission Model as your only security barrier until you update.
- That your CI pipeline installs a pinned version and not an uncontrolled "latest".

## References

- [Node.js Security Releases: October 21, 2026](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) (official advisory)
- [All Node.js security advisories](https://nodejs.org/en/blog/vulnerability)
- [Node.js release schedule](https://github.com/nodejs/release#release-schedule)
- [Node.js security advisory: Brotli decoder RCE (CVE-2026-111497)](https://vercel.com/kb/bulletin/node-js-security-advisory) (Vercel)
- [Node.js October 2026 Security Releases](https://blog.cloudlinux.com/node-js-october-2026-security-releases) (CloudLinux)

---

Is your Node.js application running on a server nobody reviews? At Codegea we audit your Node version, update and rebuild your deployment and set up [ongoing maintenance and monitoring](/en/retainer) so you do not depend on hearing about it in the news. [Tell us about your case](/en/contact).