Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws.
The Brotli decoder flaw: out-of-bounds write and the patch
The most serious bug fixed in the October 21 updates is an out-of-bounds write in the Brotli decompression code that Node.js bundles. Node.js described the impact as potentially allowing "remote code execution" when the runtime decompresses attacker-controlled Brotli data — whether via the node:zlib module or implicitly when fetch() handles a Brotli-compressed response.
The upstream fix came from the Brotli project and was copied into Node.js; it changes the decoder to catch invalid input and stop earlier rather than writing past the buffer. That change was first made in Brotli's source in February 2026 and shipped as security releases (Brotli 1.2.1, 1.1.1, and 1.0.10) on October 21.
A public proof-of-concept published on October 22 demonstrated code execution only against a deliberately weakened test build; against a standard Node.js build the proof-of-concept's author reported a crash and a limited read of process memory and said a working attack on a normal build was not achieved. Patched Node.js rejects the malformed input that the proof-of-concept uses, and no exploitation in the wild had been reported as of October 22.
Which Node.js releases contain the fixes — and which do not
Each supported release line received a specific fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the Brotli fix; Node.js advises moving such installations to a supported line.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogTLS, DNS and cryptography fixes (CVE details)
Three other fixes are rated high. Two address TLS certificate checks that an attacker could bypass by writing a server's IP address in an unusual form so that a certificate matches a host it should not (CVE-2026-106069 and CVE-2026-105483). The third prevents dns.resolve from cutting a hostname short at an embedded null byte (CVE-2026-105482). Node.js lists CVE-2026-105483 as high severity, though the commit that fixed it described the bug as low-severity and hard to exploit.
Among the medium-severity fixes is CVE-2026-106074: when an application is built as a startup snapshot or as a single-executable, crypto.randomUUID() and crypto.randomInt() could return the same values in every process, undermining assumptions that those values are unpredictable.
The eMudhra intermediate-key block and session handling
The October 21 releases also add a built-in block for eight intermediate certificate authority keys from the Indian provider eMudhra, which had been reported compromised days earlier. Node.js relies on the Mozilla root certificate list but does not perform revocation checks by default; before this update a certificate chain built on one of the compromised keys could still pass validation.
The releases update the bundled root list to remove three emSign roots and add the block on the eight keys. Go made the same block in its update on October 20. Connections resumed from a session that began before the update are not re-checked until that session times out, and end-of-life Node.js lines do not receive the block.
Updated dependencies, mitigations, and what to do if you cannot upgrade
Beyond the 10 CVEs, the updates refresh several bundled components. The copy of undici (the HTTP client behind fetch()) moves to a version that fixes three moderate advisories: one in its Subresource Integrity check and two memory-exhaustion flaws, one of them in the WebSocket client built into Node.js. Node.js also updated its bundled c-ares on all lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x to include fixes for publicly known vulnerabilities.
The advisory gives a clear operational directive: upgrading is the fix. It offers no temporary workaround for the Brotli flaw, so an application that cannot upgrade immediately has no fallback within Node.js itself. Vercel, which runs Node.js for its customers, said it added firewall rules on October 21 that block the attack in inbound requests; those rules do not cover Brotli responses an application fetches from other servers and do not replace upgrading.
What this means for technologists, platform operators, and application developers
- Technologists and security teams: prioritize upgrades to 22.23.4, 24.22.1, or 26.12.1 and ensure session timeouts are understood so previously negotiated connections do not continue to accept compromised certificates indefinitely.
- Platform operators and cloud providers: use network controls as a stopgap where possible — for example, Vercel's October 21 firewall rules for inbound requests — but recognize those measures do not cover all attack surface (notably Brotli responses fetched from other servers).
- Application developers and packagers: move any deployments still on Node.js 20.x or earlier off end-of-life lines, and rebuild single-executable or startup-snapshot applications to eliminate CVE-2026-106074's predictable values from crypto.randomUUID() and crypto.randomInt().
