Node.js Releases Security Updates to Fix High-Severity TLS, DNS and Brotli Vulnerabilities

What happened?

Node.js has released security updates for its 26.x, 24.x, and 22.x branches to address ten vulnerabilities, including four high-severity flaws affecting DNS lookups, TLS certificate checks, and Brotli decompression. The supplied release details identify 26.12.1, 24.22.1, and 22.23.4 as the patched versions. The most serious potential outcome is remote code execution through the Brotli decoder. The October security update also covers HTTP connection handling, repeated random values, ZIP processing, and filesystem permission checks.

Key details

• Node.js released security updates for 26.x, 24.x, and 22.x branches fixing ten vulnerabilities.
• Four high-severity flaws affect DNS lookups, TLS certificate checks, and Brotli decompression.
• Patched versions are 26.12.1, 24.22.1, and 22.23.4 released on October 21, 2026.
• CVE-2026-111497 is an out-of-bounds write in the Brotli decoder enabling remote code execution.
• CVE-2026-105483 bypasses TLS hostname verification when IP addresses use full-width digits.
• CVE-2026-105482 truncates DNS names containing a NUL character during resolution.
• Updates also include c-ares, CA certificates, Undici, OpenSSL, and SQLite with varying branch coverage.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.