Node.js Patches Brotli RCE Flaw, 9 Other Vulnerabilities

Node.js maintainers on Wednesday released security updates for the 26.x, 24.x and 22.x lines that fix 10 vulnerabilities, four of them rated high severity, including a Brotli decoder bug that Node.js says permits remote code execution.

The patched builds are Node.js 26.12.1, 24.22.1 and 22.23.4. According to the project’s advisory, the Brotli flaw, CVE-2026-111497, is an out-of-bounds write in the decoder and affects all three lines. Node.js did not publish CVSS scores for any of the 10 issues, and the advisory does not say what input triggers the Brotli bug or whether it is reachable remotely in a default setup.

Matteo Collina reported the Brotli flaw, and Antoine du Hamel fixed it by cherry-picking an upstream Brotli commit authored by Evgenii Kliuchnikov.

Three of the 10 flaws sit in TLS hostname verification. CVE-2026-105483 (high, 26.x and 24.x) covers a certificate hostname bypass when an IP address is written in fullwidth digits. CVE-2026-106069 (high, all three lines) covers a bypass that occurs when a host resolves to an IP address, and CVE-2026-106072 (medium, all three lines) lets DNS names in a certificate authenticate IP endpoints when the IPv4 hostname is non-canonical.

The advisory titles describe a common pattern: an address written in an unusual form is not recognised as an IP, so the certificate check falls through to the DNS names, and a certificate issued for a domain name can vouch for a connection to an IP endpoint. The fixes make TLS reject non-canonical IP addresses and correct an IP normalisation regression.

The fourth high-severity bug, CVE-2026-105482, affects all three lines. dns.resolve truncates names that contain a NUL character, and Node.js now validates resolve inputs for null bytes. The same researcher, hasanfleyah, reported that flaw, the fullwidth-digit TLS bypass and a medium-severity HTTP bug, CVE-2026-105481, in which a keep-alive socket processes a response that was written before the request was sent. James Snell fixed all three.

A second medium-severity flaw, CVE-2026-106074, affects applications that use startup snapshots or single-executable applications. The entropy caches behind crypto.randomUUID() and randomInt() were saved into the snapshot, so every process started from it repeats the same values. Node.js now resets the caches across snapshots.

The three low-severity issues are CVE-2026-106073, a Permission Model bypass through fs.realpathSync that affects all three lines, and two that affect only 26.x: CVE-2026-106071, a filesystem over-grant in the Permission Model through a wildcard lookup, and CVE-2026-106070, where the ZIP reader returns attacker-controlled prefix bytes after a failed header validation.

The releases also deal with the eMudhra certificate authority compromise. Mozilla said it received a report on Saturday, 17 October, that private keys for eight eMudhra intermediate certificates had been compromised, which could let attackers issue fraudulent HTTPS certificates for sites they do not control. eMudhra said in its statement that the affected intermediates came from a key generation ceremony held in April 2025 and that its investigation is ongoing.

All three Node.js releases now reject TLS chains that contain blocked public keys and update the bundled root certificates to NSS 3.131.1, the Mozilla trust store release that removes the root that signed the affected intermediates. The security release also updates c-ares to 1.34.9 on every line, OpenSSL to 3.5.9 on 24.x and 22.x, SQLite to 3.53.4 on 22.x, and undici on all three lines.

Node.js notes that end-of-life versions are always affected when a security release ships, so servers outside the three supported lines have no fix. Teams that distribute snapshots or single-executable apps should check whether those need rebuilding with a patched runtime.

PHP shipped fixes for its two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.