Node.js Patches 10 CVEs, Including a Brotli Out-of-Bounds Write OpenAI's Codex Security Found

A remote, unauthenticated attacker who can get a crafted Brotli stream into a decoder could corrupt memory and possibly run code, according to CVE-2026-111497, fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 on Wednesday, October 21, 2026. The Node.js project's release post rates it High and credits OpenAI Codex Security, with Khai Tran and Sylvie Mayer, as the reporter.

Upgrade to the fixed version for your line. The post lists 10 CVEs in total: 4 High, 3 Medium and 3 Low. It does not mention the 20.x line, and it says end-of-life versions are always affected in a security release.

The Brotli flaw, and a score that disagrees

The Node.js post gives one line of description for CVE-2026-111497: a Brotli decoder out-of-bounds write that permits remote code execution. It names no preconditions and no mitigations. The handles mcollina and aduh95 are credited with the fix.

The GitHub advisory record for the same CVE is more specific and covers the library itself: Google Brotli 1.0.3 through 1.2.0, on all platforms. It says a crafted stream can corrupt adjacent decoder state, disclose memory, cause a denial of service or potentially execute code, and it points to fixed releases 1.0.10, 1.1.1 and 1.2.1. NVD published the entry at 14:17 UTC on October 22.

The score and the label disagree. GitHub's record carries a CVSS v4 score of 9.2 (vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) and labels it critical, while Node.js calls the same defect High. The record is marked unreviewed by GitHub, and its weakness class is CWE-252, an unchecked return value. Any program that links Brotli 1.0.3 to 1.2.0 and decodes untrusted input, not only Node, sits inside the listed range.

The other nine CVEs

Three High-rated fixes concern how Node decides what a hostname or name is. Two of them are TLS certificate hostname bypasses.

CVE	Flaw	Severity	Lines
CVE-2026-105482	dns.resolve truncates names containing a NUL character	High	22, 24, 26
CVE-2026-105483	TLS hostname bypass with IPs in fullwidth digits	High	24, 26
CVE-2026-106069	TLS hostname bypass when a host loosely resolves to an IP	High	22, 24, 26
CVE-2026-111497	Brotli decoder out-of-bounds write	High	22, 24, 26
CVE-2026-106074	crypto.randomUUID() and randomInt() repeat values from startup snapshots	Medium	22, 24, 26

The randomUUID() entry matters for anyone who builds single executable applications or startup snapshots: the post says the entropy caches are saved into the snapshot, so separate processes repeat the same values. The remaining Medium and Low entries cover a keep-alive response-ordering bug, DNS names authenticating IP endpoints, a ZIP header validation bug and two Permission Model issues. One of those, a Low-rated bypass through fs.realpathSync (CVE-2026-106073), reaches lines 22, 24 and 26.

A CA bundle update rides along

The dependency list for 22.x, 24.x and 26.x includes a ca-cert update labelled "eMudhra Intermediate CA compromise." That ties the release to the eMudhra intermediate CA compromise already reported on this site. The release also updates c-ares and Undici on all three lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x.

The Node.js post does not say how OpenAI Codex Security found the Brotli flaw. OpenAI's separate claims about agent-found PHP flaws are covered in OpenAI's PHP vulnerability claims.

The release notes for v22.23.4, v24.22.1 and v26.12.1 hold the per-CVE mapping that the summary post omits. Those notes, and a Brotli upstream release note for 1.0.10, 1.1.1 or 1.2.1, are the next documents to read for anyone running Brotli outside Node.