ON 21 October 2026, Node[.]js released security updates for the 22.x, 24.x and 26.x lines, providing fixes for ten vulnerabilities across the platform. The most serious flaw is a Brotli decoder out-of-bounds write, tracked as CVE-2026-111497, which can lead to remote code execution. Three high-severity issues affect TLS hostname verification, enabling bypasses via unusual IP address formats, corresponding to CVEs CVE-2026-105483 and CVE-2026-106069.
A fourth high-severity issue concerns dns[.]resolve truncating names containing a NUL character, identified as CVE-2026-105482. In addition, several medium and low severity fixes address keep-alive response handling, weak IP certificate checks, and repeated startup snapshot values, with three low-severity bugs impacting ZIP handling and the Node[.]js Permission Model.
The release also trims the trust chain by removing the compromised eMudhra intermediate CA certificates from the bundled store, following actions by Mozilla, Google and Apple between 17–19 October. As a result, certificates signed with those leaked keys are no longer trusted by Node[.]js apps. There is no public evidence of exploitation in the wild for these flaws, and no confirmed PoC has been disclosed.
To mitigate, upgrade to Node[.]js 22.23.4, 24.22.1 or 26.12.1, update bundled dependencies (including c-ares, OpenSSL, SQLite and Undici), and, where necessary, rebuild apps packaged as single executables or snapshots. Full details are in the Node[.]js October 2026 security releases post, and teams are advised to apply promptly given the remote code execution risk.