Ten CVEs in one release: what the October 2026 Node.js security update fixes

On 21 October, Node.js shipped security releases for all three supported lines, 22, 24 and 26, fixing ten vulnerabilities: four rated High, three Medium and three Low [1]. No exploitation in the wild has been reported so far [2]. That is exactly the window in which patching is cheapest.

One bug stands out because it can lead to remote code execution. Most of the others share a quieter theme: Node.js being fooled about which address it is really talking to. And four of the ten are fixes for earlier fixes that didn't fully work.

The one to patch first: Brotli

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js. When the decoder meets a particular kind of invalid input, it keeps appending data to an 8-byte buffer instead of stopping. Node.js says this can crash the process, leak memory or allow code execution through node:zlib [1].

What makes it serious is how many paths lead there. Your server is exposed if it decompresses request bodies sent with Content-Encoding: br. Your server is also exposed if it makes outbound calls with fetch() or undici to a server that could be hostile, such as a webhook target, a scraper destination or a compromised partner API. WebSocket connections that use compression count too [2].

The quiet theme: trusting the wrong address

Three High and one Medium issue are about how Node.js decides that a hostname or IP address is what it claims to be [1]:

• NUL bytes in hostnames (CVE-2026-105482). dns.resolve*() stops reading at a NUL byte, so a name like attacker.example\0.trusted.example resolves as attacker.example. This is an incomplete fix of an earlier CVE.

• Fullwidth digits (CVE-2026-105483). TLS hostname checks don't recognise an address written with fullwidth digits as an IP, so a certificate meant for a name can authenticate it. This is a regression of an earlier fix.

• Leading zeros (CVE-2026-106069) and odd IPv4 spellings (CVE-2026-106072). Addresses like 0127.0.0.1 or 0x7f.0.0.1 are read one way by the URL parser and another way by some operating systems, so a certificate can be checked against a different IP than the one Node.js actually connects to.

If your code uses allowlists to stop server-side request forgery, pins TLS to IP addresses, or lets users supply URLs that your servers then fetch, these are the bugs that quietly undo those protections.

Randomness that isn't

CVE-2026-106074 affects anyone who builds startup snapshots or single executable applications. The entropy caches behind crypto.randomUUID(), randomUUIDv7() and randomInt() were saved into the snapshot, so every process started from it produces the same sequence [1]. If those values become session IDs, reset tokens or idempotency keys, they are predictable.

"Patched" is not a final state

Four of the ten CVEs exist because an earlier fix was incomplete or later regressed [1]. That pattern is common, and it is why a vulnerability scan from last quarter says little about today. The same release also updated bundled dependencies, including OpenSSL, c-ares, SQLite and Undici, and the CA bundle to drop the compromised eMudhra intermediates [1].

Where old Node.js hides

Upgrading the Node.js on a developer laptop is the easy part. The versions that stay vulnerable are usually [2]:

• container images built from older node:* base tags and never rebuilt;

• single executable applications compiled with an old runtime;

• serverless and managed platforms, which patch on the vendor's schedule;

• anything still on Node.js 20 or earlier, which is end of life and will not be fixed.

A checklist for your own setup

• Is every service on 22.23.4, 24.22.1 or 26.12.1 or later, including the ones in containers?

• Have we rebuilt images and single executable binaries, rather than just updating the host?

• Do any of our APIs accept Brotli-compressed request bodies? If we can't patch today, can the proxy strip Content-Encoding: br?

• Do our SSRF allowlists and URL validators normalise IP addresses before comparing them?

• Are tokens or IDs generated in processes started from a snapshot?

• Are we still running Node.js 20 or older anywhere?

Get your complete exposure report

Knowing a patch exists is not the same as knowing where you need it. NexusVoid maps what you expose to the internet and the runtimes behind it, finds the services and images still on vulnerable versions, and gives you a fix for each finding. Our 24/7 monitoring tests every newly disclosed vulnerability against your stack as it appears, so the next release doesn't wait for your next audit. Get your complete exposure report →

References

1. Node.js. "Wednesday, October 21, 2026 Security Releases." nodejs.org

2. Astra Security. "Node.js Security Release (October 2026): Brotli RCE + 9 CVEs." getastra.com

3. Cybersecurity News. "Node.js Releases Security Updates to Fix High-Severity TLS, DNS, and Brotli Vulnerabilities." cybersecuritynews.com