HOC Shorts |
Node.js released security updates across all supported active release lines (22.x, 24.x, and 26.x) addressing 10 vulnerabilities.
- The Core Threat: The most severe flaw is a high-severity out-of-bounds write bug in the bundled Brotli decompression library (`CVE-2026-111497`), which could potentially allow unauthenticated remote code execution (RCE).
- Attack Surface: Triggered whenever Node.js decompresses untrusted Brotli data—either directly via the `node:zlib` module or automatically when applications invoke `fetch()` responses.
- Additional Fixes: The patch bundle also rectifies TLS hostname-check bypasses, `dns.resolve` truncation bugs, and removes trust for compromised eMudhra intermediate certificates.
- Required Action: Administrators must upgrade immediately to v22.23.4, v24.22.1, or v26.12.1.
Critical Node.js Brotli Decoder Vulnerability (`CVE-2026-111497`) Forces Emergency Updates
The Node.js security team has rolled out urgent patches across all supported release channels to resolve 10 distinct security vulnerabilities. Headlining the advisory is a high-severity out-of-bounds write flaw residing in the built-in Brotli decompression module (`CVE-2026-111497`), capable of triggering memory corruption and potential remote code execution.
Because Node.js bundles its own copy of Google’s Brotli compression library rather than relying on host packages, applications utilizing standard decoding functions are directly exposed.
Technical Breakdown of the Brotli Decoder Flaw
[Malformed Brotli Compressed Payload]
│
▼
[Node.js node:zlib or fetch() Processing]
│
▼
[Out-of-Bounds Write in Bundled Brotli Decoder (CVE-2026-111497)]
│
▼
[Memory Corruption / Potential Unauthenticated RCE]
- The Mechanism: The vulnerability stems from improper input validation within the Brotli decompression engine. Specially crafted, malformed compressed input can cause the decoder to write past buffer boundaries.
- Exposure Vector: Any Node.js service that processes untrusted Brotli payloads—such as parsing incoming HTTP request bodies or consuming external API responses via `fetch()`—is vulnerable if fed malicious data.
- Real-World Exploit Feasibility: While the project classifies the risk as high with potential for remote code execution, published proof-of-concept tests against standard production builds currently result in immediate process crashes and limited memory reads rather than full arbitrary code execution. Nonetheless, upgrading is critical.
Summary of Patched Node.js Versions
| Release Line | Patched Version | Support Status / Action Required |
| Node.js 26.x | v26.12.1 |
Current line; upgrade immediately |
| Node.js 24.x | v24.22.1 |
Long-Term Support (LTS); upgrade immediately |
| Node.js 22.x | v22.23.4 |
Long-Term Support (LTS); upgrade immediately |
| Node.js 20.x & Older | None | End-of-Life (EOL); receive no fixes. Must migrate to a supported branch. |
Node.JS updates are now available for the 26.x, 24.x, 22.x lines for the following issues.
This security release includes the following dependency updates to address public vulnerabilities:
- c-ares on 26.x, 24.x, 22.x
- ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x
- OpenSSL on 24.x, 22.x
- SQLite on 22.x
- Undici on 26.x, 24.x, 22.x
Other High-Severity Flaws Addressed in the Patch Bundle
Beyond the Brotli memory corruption bug, the October update resolves several other critical components:
1. TLS Hostname-Check Bypasses (`CVE-2026-106069` & `CVE-2026-105483`): Resolves flaws where attackers could bypass TLS certificate hostname verification by passing IP addresses in non-canonical formats or full-width digits.
2. DNS Resolution Truncation (`CVE-2026-105482`): Fixes a bug in `dns.resolve` that prematurely truncated hostnames containing embedded null bytes.
3. eMudhra Certificate Revocation: Removes trust for eight intermediate Certificate Authority keys from provider eMudhra following recent compromise reports.
