Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)
› Node.js
- started
- Oct 21, 2026
- closed
- ongoing
- CVEs
- 10
- sources
- 7
## summary
On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.
severity: Highest vendor severity HIGH (Brotli RCE CVE-2026-111497 and several TLS/DNS highs); CVSS not published by Node.js for all items
## cve ids[10]
## affected
- 22.x, 24.x, 26.x (EOL lines not patched)
## fixed in
- 22.23.4
- 24.22.1
- 26.12.1
## timeline[2]
Node.js published the Wednesday security releases and advisory.
Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes.
## advisories[3]
## posts[4]
🔐 Node.js security updates are now available! New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues. Review the details and update your systems to stay secure. 🔗 t.co/W4kfzx5lxz #NodeJS #Security
🚨 BREAKING: Node.js just dropped its OWN security bombshell. 4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers. → 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated t.co/k3Vb8WK1eC
The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4. #NodeJS #CVE2026111497 #CVE2026105483 #CVE2026106069 #RemoteCodeExecution #TLS #JavaScript #CyberSecurity t.co/2Rmy6FPWq0
Breaking 🚨 - Node.js October 2026 Security Releases – High severity fixes available now! Security updates are out for the supported Node.js lines: 26.x, 24.x, and 22.x. Highest severity is HIGH. Key issues include: • TLS non-canonical IP address handling (CVE-2026-106069 / t.co/npxfOdxGdg
## notes & caveats
CVE list and fixed versions taken from the official Node.js advisory. No widespread exploitation claimed by Node.js as of Oct 22; keep live until fleet uptake is clearer. One of the four selected tweets is the official @nodejs announcement.
