nodejs

Node.js October 2026 security release: a Brotli RCE and three ways to fool TLS hostname checks

Node.js shipped security releases across all three supported lines on 2026-10-21, fixing 10 CVEs. The headline is an out-of-bounds write in the bundled Brotli decoder that can end in remote code execution, plus three high-severity bypasses in TLS hostname verification that share a single root cause.

Glenn Fryklund

Glenn Fryklund

— 3 min read
Share
A data stream striking a chip and cracking it open, leaking red memory fragments.
A data stream striking a chip and cracking it open, leaking red memory fragments. Rendered with AI.

On 2026-10-21, the Node.js project published security releases for all three supported lines: v26.12.1, v24.22.1, and v22.23.4. The batch fixes 10 CVEs. No known exploitation is reported by the vendor or NVD, but the severity mix warrants an update on any self-hosted Node deployment.

The Brotli decoder can be made to execute code

CVE-2026-111497 (high) is an out-of-bounds write in the Brotli decoder that Node.js bundles, inherited from upstream Google Brotli 1.0.3 through 1.2.0. A crafted Brotli-compressed stream corrupts adjacent decoder state. Depending on the corruption, the outcome is sensitive memory disclosure, denial of service, or arbitrary code execution.

The exposure surface is wider than it looks. Brotli is a standard HTTP content encoding. Any Node application that decodes content-encoding: br responses or archives is exposed to this class of input. The fix ships in the updated release, and there is no workaround short of not decoding untrusted Brotli.

Three TLS hostname verification bypasses, one root cause

The release fixes three high-severity bypasses in tls.checkServerIdentity(), and they point at the same weakness.

CVE-2026-105483: when an IPv4 host is written with non-ASCII or fullwidth digits (for example １２７.0.0.1), Node matched it against DNS SANs and CNs instead of treating it as an IP. This is a regression after CVE-2026-48618. It affects 26.x and 24.x.

CVE-2026-106069: a non-canonical IPv4 literal with a leading zero (for example 0127.0.0.1) is read as octal by WHATWG URL normalization but as decimal by the OS resolver on some platforms. The result is that a certificate issued for a different IP is accepted.

CVE-2026-106072: non-canonical IP addresses in general are accepted where they should not be. It affects 26.x, 24.x, and 22.x.

The common thread is that hostname verification is only as strong as the weakest normalization step in the chain. The URL parser, the OS resolver, and the certificate matcher each have their own notion of what 0127.0.0.1 means, and this batch of fixes closes the gaps between them. The operational lesson: if you rely on hostname verification as a trust boundary, treat canonical form as a property of the whole stack, not of a single library.

DNS resolution truncates NUL-byte hostnames

CVE-2026-105482 (high): dns.resolve*() and dns.reverse() silently truncate hostnames containing a NUL byte. The name is passed to c-ares as a C string, so everything after the NUL is dropped. An application that validates a hostname against a domain allowlist and then resolves it can end up acting on records for a different name. This is an incomplete fix of CVE-2026-48930. It affects 26.x, 24.x, and 22.x.

The same trust-boundary pattern as the TLS bypasses: a string that looks valid in one API layer gets truncated in another.

The rest of the batch

  • CVE-2026-106074 (medium): the crypto entropy caches used by crypto.randomUUID(), randomUUIDv7(), and getRandomValues() are not reset across snapshots. Snapshot-based workers can reuse entropy state.
  • CVE-2026-105481 (medium): HTTP agent data guard without I/O.
  • CVE-2026-106070 (low): zlib invalid ZIP local header caching.
  • CVE-2026-106071 (low): fs permission tree node on wildcard nodes.
  • CVE-2026-106073 (low): permission model check in realpathSync.

Dependency updates in the same release

The release also bundles updates to c-ares, ca-cert (for the eMudhra Intermediate CA Compromise), OpenSSL (24.x and 22.x), SQLite (22.x), and Undici. The ca-cert update matters if you are tracking the eMudhra story: the compromised intermediate CAs are being removed from the trust store.

What to do

Update to v26.12.1, v24.22.1, or v22.23.4 depending on your line. There is no known exploitation, but the Brotli RCE and the TLS bypasses are the kind of fix you want in place before they are.

Sources

This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.

Topics:

Read more