Node.js October 2026 Security Release: Brotli RCE and 9 More CVEs

On October 21, 2026, Node.js shipped security releases that fix 10 vulnerabilities across the 22.x, 24.x and 26.x lines. Four are rated High. The most serious, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder, and the project says it permits remote code execution. To fix it, upgrade to v22.23.4, v24.22.1 or v26.12.1. The advisory lists no workarounds.

This post covers what was fixed, who needs to act, and a step-by-step upgrade checklist for teams and app owners.

What the October 2026 Node.js security release fixes

The official advisory on nodejs.org lists ten CVEs. Here they are, grouped by severity:

The release also updates several bundled dependencies, including c-ares, OpenSSL (to 3.5.9 on the 22.x and 24.x lines), undici, SQLite (on 22.x) and the root certificate store. The advisory says the certificate update relates to an eMudhra intermediate CA compromise.

The Brotli RCE: why it is the headline

Brotli is a compression format that web servers and browsers use widely, and Node.js ships its own copy of the Brotli library. According to the release notes, the fix for CVE-2026-111497 cherry-picks an upstream Brotli commit. It also exposes a new decoder error constant, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, so malformed input now produces a clean error.

The problem is in the upstream library itself, not just in Node.js. Google's Brotli project published patched releases (v1.2.1, v1.1.1 and v1.0.10) on the same day, each labeled "out-of-bounds write permits remote code execution" with the same CVE ID. Other runtimes and tools that bundle Brotli may also need updates, so watch the advisories for your other stacks too.

Neither the Node.js advisory nor the Brotli release notes publish exploit details. In practice, the code most worth checking is any code that decompresses Brotli data you don't control. Examples include request bodies sent by clients, responses from third-party APIs, and files uploaded by users. If your app does any of that, treat this as a priority patch.

The TLS and DNS bugs: quieter but still serious

Three of the four High-severity issues involve how Node.js checks who it is talking to.

• Two TLS hostname bypasses (CVE-2026-105483, CVE-2026-106069). In some edge cases, Node.js could accept a certificate for the wrong host when the address was written in an unusual form, such as fullwidth digits or a loosely parsed IP. The fix commits are titled "tls: fix ip normalization regression" and "tls: reject non-canonical IP addresses".
• DNS NUL-byte truncation (CVE-2026-105482). dns.resolve could truncate a name at a NUL character, so the name that gets resolved is not the one your code passed in. The fix validates inputs for null bytes.

These bugs matter most for apps that build hostnames or URLs from user input. Common examples are webhook senders, link previewers, URL importers and anything that fetches a URL a customer typed in. In those features, a validation gap can turn into server-side request forgery (SSRF) or a man-in-the-middle risk.

A note on random values in snapshots

CVE-2026-106074 is easy to miss. If you build user-land startup snapshots or single executable applications (SEAs), the entropy caches behind crypto.randomUUID() and randomInt() could be saved into the snapshot. As a result, every process started from it would generate the same values. If you use either feature and rely on those functions for IDs or tokens, upgrade and rebuild your snapshots or executables.

Which Node.js versions are affected (and which are end-of-life)

According to the Node.js release schedule:

• Node.js 26.x is the Current line. Fixed in v26.12.1.
• Node.js 24.x is Active LTS. Fixed in v24.22.1.
• Node.js 22.x is Maintenance LTS until April 30, 2027. Fixed in v22.23.4.
• Node.js 20.x reached end-of-life on April 30, 2026. Node.js 18.x ended on April 30, 2025, and 25.x ended on June 1, 2026.

Upgrade checklist for your team

Here is a practical order of operations that works for most teams.

1. Find every place Node.js runs. Check your servers, Docker images, CI runners, serverless functions, build machines and Electron apps. Don't forget internal tools and cron workers.
2. Check the version on each one.

node -v
# Patched: v22.23.4+, v24.22.1+ or v26.12.1+

3. Pin the patched version in config. Update .nvmrc, engines in package.json, your CI setup, and your Docker base images.

{
  "engines": {
    "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1"
  }
}

- FROM node:22.23.3-alpine
+ FROM node:22.23.4-alpine

If you use floating tags such as node:22-alpine, rebuild and redeploy anyway. An image built last week still contains the old binary.

4. Check your hosting platform. On managed platforms and serverless runtimes, check the provider's docs or status page to see when the patched runtime is rolled out, and whether you need to redeploy to pick it up.
5. Prioritize risky code paths. Start with services that decompress untrusted Brotli data or make outbound TLS or DNS calls to hosts derived from user input.
6. Rebuild snapshots and SEAs if you use them, so the CVE-2026-106074 fix takes effect.
7. Run your test suite and smoke tests before rolling out to production. These are patch releases, but bundled dependencies such as OpenSSL and undici also changed.
8. Plan your exit from Node.js 20 or older if any service is still on an end-of-life line.

What this means for business and app owners

If you run a SaaS product, an online store, or an app someone built for you, you probably have Node.js running somewhere, even if you never chose it. It might sit behind your API, your Next.js frontend, your background jobs or your build pipeline. Apps built quickly with AI tools such as Lovable, Bolt or Replit often run on Node.js too, and nobody may be tracking which version they use.

Here are the questions to ask your developer or agency this week:

• Which Node.js version does each part of our app run on?
• Have we upgraded to the October 21 patched releases, and when was the last redeploy?
• Is anything still on Node.js 20 or older?
• Do we have a routine for applying runtime security releases, or do we rely on someone noticing?

If nobody can answer those clearly, the gap is in process, not just this one patch. A production audit can map what you run, how current it is, and where the risky code paths are. If your backend needs a longer-term owner, see Node.js backend development.

Sources

• Node.js Security Releases: Wednesday, October 21, 2026 (nodejs.org) (opens in a new tab)
• Node.js v24.22.1 release notes (GitHub) (opens in a new tab)
• Node.js v22.23.4 release notes (GitHub) (opens in a new tab)
• google/brotli releases (GitHub) (opens in a new tab)
• Node.js release schedule (GitHub) (opens in a new tab)
• Cover photo: FlyD on Unsplash