After PHP and eMudhra, Here Comes Node.js

Yesterday (21. Oct), php2shell dominated the conversation, drawing the attention and concern of developers and security teams everywhere. At the same time, the eMudhra intermediate CA certificates case raised alarms of their own. Then Node.js shipped a security release containing fixes for 10 vulnerabilities. Among them is CVE-2026-111497, a critical vulnerability in the Brotli decoder that ships with Node.js which could lead to Remote Code Execution (RCE).

TL;DR — What about Node.js; how to stay safe

On October 21, Node.js published a security release that fixes 10 vulnerabilities across the 22.x, 24.x, and 26.x release lines. The vulnerabilities have various severities, but given the presence of a few significant ones, we strongly advise quick action to mitigate these risks. Among them is CVE-2026-111497, affecting the Brotli decoder that is shipped with Node.js; this vulnerability allows remote code execution. The same release also updates various vulnerable third-party dependencies, including a fix to address the eMudhra CA compromise.

The quickest remediation, regardless of the vulnerability in question, is to update Node.js to one of the fixed versions, depending on your release line: 22.23.4, 24.22.1, and 26.12.1.

What is included in the Node.js security release?

This security release involved the disclosure of 10 CVEs: four are High, three are Medium, and another three are Low. Node.js assigned these severities, and they haven’t yet been reviewed by the US National Vulnerability Database (NVD) or similar organizations. Our own assessment and CVSS score differs in two cases from the severities Node.js assigns. We recommend addressing all of these CVEs, regardless of severity, since they can all be addressed by the same upgrade paths.

The vulnerability that deserves the most urgent attention is CVE-2026-111497: Node.js describes it as an out-of-bounds write in the Brotli decoder that could lead to RCE, allowing an attacker to gain the same rights as the impacted node process. The issue resides in the implementation of Brotli, a compression algorithm, as shipped in Node.js. This algorithm can be used through the node:zlib module or via the built-in fetch(). Node.js apps that decompress user-controlled data via the node:zlib module or fetch untrusted Brotli data, via request body or response, might be exposed. Thanks to mcollina for reporting this vulnerability and to aduh95 for fixing it.

Given the high impact, and specific conditions, our CVSS assessment for this CVE led us to classify this as critical-severity. Risk can be lower or higher depending on how this is implemented in each use case; as always, individual organizations are encouraged to engage in a CVSS Environmental scoring exercise or similar prioritization effort before making a final risk determination.

Node.js also fixes an issue in the dns.resolve() function that truncated names containing NUL characters (CVE-2026-105482), which could create uncertainty about what the application validates and what gets resolved. Thanks to hasanfleyah for reporting this vulnerability and to jasnell for fixing it.

The remaining two high-severity vulnerabilities are related to TLS issues allowing hostname bypass. Regarding CVE-2026-105483, this could allow the compromise of TLS hostname verification, leading to a potentially critical impact. Thanks again to hasanfleyah for reporting it and to jasnell for fixing it.

The CVE-2026-106069 commit makes tls.checkServerIdentity() reject hosts that only become IP addresses after IDNA normalization. Before the change, Node validated the certificate against the normalized address, while the platform resolver could interpret the original string as a different one. Thanks to anagnorisis2peripeteia for reporting this vulnerability and to mcollina for fixing it.

Although not covered in more detail, the following six CVEs are important and should be addressed as well. They affect the same release lines, and upgrading to the latest version is recommended:

• CVE-2026-105481 (Medium) – HTTP keep-alive socket may accept a response from a previous request (credit to hasanfleyah for reporting and jasnell for fixing).
• CVE-2026-106072 (Medium) – Improper certificate validation for non-canonical IPv4 hostnames (credit to br41ny for reporting and mcollina for fixing).
• CVE-2026-106074 (Medium) – Predictable random values caused by entropy caches in startup snapshots (credit to gesposito for reporting and mcollina for fixing).
• CVE-2026-106070 (Low) – ZIP parsing can expose attacker-controlled bytes after validation fails (credit to startimeash for reporting and mcollina for fixing).
• CVE-2026-106071 (Low)- Filesystem permission over-grant caused by wildcard matching (credit to malikhamzaiqbal for reporting and jasnell for fixing).
• CVE-2026-106073 (Low) – Permission Model bypass through fs.realpathSync() (credit to 0xoroot for reporting and RafaelGSS for fixing).

How to stay safe

The best way to stay safe is by updating Node.js to the following versions according to your release line:

• 22.x → 22.23.4
• 24.x → 24.22.1
• 26.x → 26.12.1

Older versions are no longer maintained, so if you’re running one of those, we strongly recommend migrating to a supported release line.

Conclusion

CVE-2026-111497 shows why severity scores deserve a second look. Node.js rates it High, but our CVSS assessment makes it critical: an attacker who triggers the out-of-bounds write could potentially run code with the same rights as your Node.js process. Ultimately, what matters is the impact on your organization: any application that decompresses untrusted Brotli data may be exposed. Don’t wait for the severity debate to settle: update to 22.23.4, 24.22.1, or 26.12.1 now.