A Brotli decoder flaw that permits remote code execution is among the issues fixed in three Node.js branches. The October 21 security bulletin also covers certificate checks, DNS handling and permission boundaries.
The fixed releases are 26.12.1, 24.22.1 and 22.23.4. Node.js is the runtime that executes JavaScript outside a browser, including on application servers. Its bundled libraries therefore sit inside many other products.
The Brotli issue, CVE-2026-111497, involves an out-of-bounds write, where software writes beyond the memory area it should use. The project rates it high severity and lists all three release lines as affected.
Three other high-severity entries concern DNS names truncated at a NUL character and two forms of TLS hostname-validation bypass. Those checks help an application establish that a certificate matches the endpoint it intended to contact.
The bulletin lists these CVEs and severities:
| CVE | Issue | Severity |
|---|---|---|
| CVE-2026-105482 | DNS name truncation | High |
| CVE-2026-105483 | Fullwidth-digit TLS hostname bypass | High |
| CVE-2026-106069 | IP-resolution TLS hostname bypass | High |
| CVE-2026-111497 | Brotli out-of-bounds write and code execution | High |
| CVE-2026-105481 | Keep-alive response handling | Medium |
| CVE-2026-106072 | Non-canonical IPv4 certificate validation | Medium |
| CVE-2026-106074 | Repeated random values in startup snapshots | Medium |
| CVE-2026-106070 | ZIP header-validation behavior | Low |
| CVE-2026-106071 | Permission wildcard over-grant | Low |
| CVE-2026-106073 | Permission bypass through fs.realpathSync | Low |
Not every issue affects every branch. The fullwidth-digit flaw affects 26.x and 24.x; the ZIP and wildcard issues affect 26.x. The bulletin gives the branch mapping for each entry.
The release also updates dependencies, including certificate data for the eMudhra compromise. Patching a browser does not update a separately installed Node.js runtime. The runtime needs its own security release.
