Node.js Ships Emergency Security Fixes, Including a Flaw That Runs Attackers' Code

The Node.js project released emergency security updates on Wednesday, October 21, patching 10 vulnerabilities in the JavaScript runtime that powers a large share of the world's web servers, APIs and build tools. The fixed versions are 22.23.4, 24.22.1 and 26.12.1. Four of the flaws are rated high severity, and the project repeated its standing warning that end-of-life versions are always affected when a security release lands, with no patch coming for them.

The worst of the four

The most serious bug, tracked as CVE-2026-111497, sits in the Brotli decoder bundled with Node.js. Brotli is a compression format used across the web. Malformed compressed data can make the decoder write outside its intended memory area, and researchers showed the flaw can be pushed all the way to remote code execution, running with the permissions of the Node.js process itself. The catch is exposure: Node.js does not decode Brotli on its own. A server is at risk when its code, or a library it uses, decompresses Brotli data an attacker controls, either in a request it receives or in a response it fetches from somewhere else.

Broken identity checks

Two more high severity flaws, CVE-2026-105483 and CVE-2026-106069, weaken TLS certificate hostname verification, the check that confirms a server is really who it claims to be. Unusual ways of writing an IP address, including one that uses full-width digits, could slip a wrong certificate past the check. A fourth, CVE-2026-105482, makes the DNS resolver cut off names that contain a NUL character. The remaining fixes cover HTTP keep-alive mix-ups, repeated random values in startup snapshots, ZIP handling and permission checks.

A quiet certificate cleanup

The same release updates the bundle of trusted certificate authorities Node.js ships with, dropping trust in certificates tied to the compromised eMudhra intermediate authority. Mozilla, Google and Apple blocked those certificates between October 17 and 19 after the eMudhra key compromise came to light, a case India's IT ministry is still probing. Node.js apps will now refuse the affected certificates as well.

Who needs to move

Anyone running Node.js 22, 24 or 26 in production should install the patched builds and restart their services, since an update does not change a process that is already running. Teams still on Node.js 20 or older have a harder problem: those lines reached end of life, Node 20 on April 30, 2026, and they will never receive these fixes. For them the only safe option is to move to a supported line.