Node.js 26.12.1, 24.22.1 and 22.23.4 fix a Brotli overflow that can reach remote code execution

Node.js shipped security releases on October 21, 2026 for all three supported lines: v26.12.1, v24.22.1 and v22.23.4. The project's advisory lists ten CVEs, four of them rated high, plus dependency updates for c-ares, OpenSSL, SQLite and Undici, and a CA store change labeled "eMudhra Intermediate CA Compromise." The fix most teams should look at first is CVE-2026-111497, a memory-corruption bug in the Brotli decoder that Node.js bundles behind node:zlib.

A decoder that kept reading

The advisory describes the root cause precisely. Malformed input caused an error to be misclassified, and the decoder kept going:

An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer.

Node.js security advisory, October 21, 2026

The consequence, in the advisory's words: "An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution." It affects 26.x, 24.x and 22.x. Node.js rates it high and publishes no CVSS score. The report is credited to "OpenAI Codex Security - Khai Tran and Sylvie Mayer," with the fix by Node.js maintainers mcollina and aduh95.

The exposure test is narrow and easy to state: does any code path decompress Brotli data that someone outside your trust boundary controls? The advisory does not list specific APIs beyond node:zlib, and it offers no workaround, so the remediation is the upgrade.

Three ways to fool a hostname check

Two of the other high-severity fixes, and one medium, are in tls.checkServerIdentity(), the function that decides whether a server certificate matches the host a client asked for. All three involve IPv4 addresses written in unusual forms.

• CVE-2026-106069 (high): with a leading zero, the two halves of the stack disagree about which address is meant. The advisory explains that tls.checkServerIdentity() follows WHATWG URL rules, "which read a leading-zero octet as octal (0127.0.0.1 becomes 87.0.0.1), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (127.0.0.1)." A server at one address can then present a certificate issued for another.
• CVE-2026-105483 (high, 26.x and 24.x): an address written with fullwidth digits (１２７.0.0.1) was not recognized as an IP, so it was matched against the certificate's DNS names. The advisory calls this "a regression introduced after the fix for CVE-2026-48618."
• CVE-2026-106072 (medium): spellings such as 0x7f.0.0.1, 2130706433 or 127.1 let a certificate carrying only DNS:127.0.0.1, and no IP SAN, authenticate an IP endpoint. The advisory notes this needs a client-trusted CA to have issued a certificate with a numeric DNS SAN, and a resolver such as glibc that accepts those spellings.

Fixes of earlier fixes

Three CVEs in this batch are labeled incomplete fixes of earlier ones. The clearest is CVE-2026-105482 (high): hostnames containing a NUL byte were silently truncated by dns.resolve*() and dns.reverse(), because the earlier fix for CVE-2026-48930 "only covered dns.lookup() and the net/tls host options." The advisory's example: resolving attacker.example\0.trusted.example "queries attacker.example and returns its records without any error," which defeats an allowlist check done on the full string. CVE-2026-105481 completes CVE-2026-48931, and CVE-2026-106073, a Permission Model bypass with fs.realpathSync, completes CVE-2026-21715.

One medium fix is worth knowing about if you build startup snapshots or single executable applications. Under CVE-2026-106074, the entropy caches behind crypto.randomUUID(), crypto.randomUUIDv7() and crypto.randomInt() could be saved into a snapshot. Every process started from it then returns the same values "until the cache is refilled: up to 127 UUIDs and about 1,000 randomInt() values."

What to do

Move to v26.12.1, v24.22.1 or v22.23.4. Anything older than the supported lines gets no patch, and the advisory is blunt about it: "End-of-Life versions are always affected when a security release occurs." If you rebuilt snapshots or SEAs on an affected version, rebuild them on the fixed one, since the repeated values are baked into the artifact.

Primary sources: Node.js, "Security Releases: October 21, 2026", read 2026-10-27.