Node.js Brotli vulnerability fixed across supported lines
The Node.js Brotli vulnerability has been fixed across the platform's three supported release lines as part of security updates issued on October 21. The releases address 10 flaws, led by CVE-2026-111497, a high-severity problem that the Node.js project says could allow remote code execution, meaning an attacker could make an affected system run code of the attacker's choosing.
The fixed releases are Node.js 22.23.4 and 24.22.1 on the long-term support lines, plus 26.12.1 on the current line. Node.js 20.x and every earlier line have reached end of life, meaning they no longer receive security fixes. Applications still using those releases therefore need to move to a supported line rather than wait for a patch.
CVE-2026-111497 affects the Brotli decoder bundled with Node.js. Brotli is a compression library from Google that reduces the size of transferred data. Node.js can invoke its bundled copy directly through the node:zlib module or automatically when fetch() receives a response compressed with Brotli. Exposure arises when an application decompresses Brotli data controlled by an attacker, including a submitted request body or a response retrieved from another server.
The underlying fault is an out-of-bounds write, which occurs when software places data beyond the memory space reserved for it. Malformed compressed input can trigger the decoder to write past its buffer. Node.js incorporated an upstream correction from the Brotli project that detects the invalid input and stops processing sooner. The same correction appeared in Brotli 1.2.1, 1.1.1 and 1.0.10 on October 21, so software other than Node.js that includes its own Brotli copy may also require an update. The code change was initially made in Brotli's source in February 2026 but did not ship as a security release until October.
The Node.js project describes possible remote code execution, but the demonstrated results are more limited. A public proof of concept released on October 22 achieved code execution only with an intentionally weakened test build. On a standard Node.js build, its author reported a crash and a restricted read of process memory, and did not produce a working code-execution attack. Updated Node.js releases reject the malformed input used by that demonstration. No exploitation in the wild had been reported as of October 22.
Three other vulnerabilities carry a high rating. CVE-2026-106069 and CVE-2026-105483 affect Transport Layer Security (TLS) hostname checks, which help confirm that an encrypted connection has reached the intended server. Unusual representations of an Internet Protocol address could make a certificate match a host that it should not. CVE-2026-105483 specifically involves IP addresses written with fullwidth digits and affects 24.x and 26.x; Node.js rates it high even though the fixing commit describes it as low severity and difficult to exploit. CVE-2026-105482 causes dns.resolve, a function that looks up names through the Domain Name System (DNS), to cut off a hostname at an embedded null byte. CVE-2026-106069, CVE-2026-105482 and the Brotli flaw affect 22.x, 24.x and 26.x.
The medium-severity set includes CVE-2026-105481, in which a reused keep-alive connection can process a response written before its request was sent, and CVE-2026-106072, which lets DNS names authenticate IP endpoints when non-standard IPv4 formatting is involved. CVE-2026-106074 causes crypto.randomUUID() and crypto.randomInt() to return the same values in every process when an application is packaged as a startup snapshot or single-executable application. A startup snapshot stores an application's prepared state for reuse. Repeating supposedly unpredictable values can undermine application functions that depend on their randomness. All three medium-severity issues affect 22.x, 24.x and 26.x.
Three low-severity flaws complete the set. CVE-2026-106070 allows ZipFile in 26.x to return attacker-controlled bytes after a failed header check. CVE-2026-106071 can grant more file access than intended through a wildcard lookup in the Permission Model and affects 26.x. CVE-2026-106073 provides a Permission Model bypass through fs.realpathSync and affects all three supported lines.
The releases also change certificate handling after eight intermediate certificate authority keys from eMudhra were reported compromised. A certificate authority issues credentials used to establish the identity of an online service. Node.js relies on Mozilla's root certificate list but does not check revocation by default, so chains based on those keys could previously continue to pass validation. The updates add a built-in block for all eight keys and remove three emSign roots from the bundled list. Go introduced the same block in an October 20 update. Connections resumed from sessions established before updating are not checked again until those sessions expire, while end-of-life Node.js lines do not receive the block.
Bundled dependencies received further updates. Undici, the HTTP client behind fetch(), moved to a release addressing three moderate advisories: one affecting Subresource Integrity checking and two involving memory exhaustion, including one in the WebSocket client included with Node.js. The project also updated c-ares on every supported line, OpenSSL on 22.x and 24.x, and the relational database used by many web applications on 22.x to incorporate fixes for publicly known vulnerabilities.
Upgrading is the prescribed fix, and the advisory provides no temporary Node.js workaround for the Brotli vulnerability. Vercel said it deployed firewall rules on October 21 to stop the attack through incoming requests, but those rules do not cover Brotli-compressed responses that an application fetches from external servers and do not replace the updates. For businesses needing support with this work, AEU-I provides security-first IT, infrastructure and consulting. Website operators should verify the Node.js version actually running each application, including managed or containerised deployments, rather than assuming an operating-system update changed the application runtime.