Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not Hold
Security / news
Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not Hold
The worst, a Brotli decoder write past an 8-byte buffer, needs an app that decompresses attacker-supplied data, and Qualys counts 1.7 million installs on lines that will never get a fix.
Node.js fixed 10 CVEs on Oct. 21 in versions 26.12.1, 24.22.1 and 22.23.4, and four of them are described in the project's own advisory as an incomplete fix or a regression of an earlier CVE. The most serious, CVE-2026-111497, is a Brotli decoder bug that can lead to remote code execution when an app decompresses attacker-supplied data.
The Node.js security release notice rates four issues High, three Medium and three Low. It credits OpenAI Codex Security, with named individuals Khai Tran and Sylvie Mayer, for the Brotli report.
CVE-2026-111497: what the Brotli decoder does wrong
The advisory says an invalid block switch is treated as "need more input", so the decoder keeps writing past an 8-byte buffer. Impact ranges from a crash to memory disclosure to code execution. The precondition is narrow and specific: the application must decompress attacker-supplied Brotli data through node:zlib. That covers HTTP clients and proxies handling Content-Encoding: br and services that accept uploaded compressed files, per a Qualys post by Saeed Abbasi, who heads its Threat Research Unit.
Qualys scores it 9.2 on CVSS 4.0. Neither Node.js nor Qualys says it is exploited in the wild, and Node.js publishes no workaround. Qualys suggests avoiding Brotli decompression of untrusted input and limiting payload size and decompression ratio at the proxy.
Four fixes that did not hold the first time
The advisory labels these as follow-ups. Each one names the earlier CVE it failed to close.
| CVE | Severity | Component | What it follows |
|---|---|---|---|
| CVE-2026-105482 | High | dns.resolve*(), dns.reverse() | Incomplete fix of CVE-2026-48930 |
| CVE-2026-105483 | High | tls.checkServerIdentity() | Regression from the CVE-2026-48618 fix |
| CVE-2026-105481 | Medium | HTTP Agent keep-alive | Incomplete fix of CVE-2026-48931 |
| CVE-2026-106073 | Low | fs.realpathSync() | Incomplete fix of CVE-2026-21715 |
CVE-2026-105482 shows how the pattern plays out. Hostnames with a NUL byte are silently truncated, so attacker.example\0.trusted.example resolves as attacker.example. The precondition is an app that validates a hostname and then resolves it with dns.resolve*(). Reporter Hasan Flayyih Abdullah found three of the four follow-ups, according to the advisory.
CVE-2026-106073 is the odd one out in severity: fs.realpathSync() skips read-permission checks, so code run under --permission can probe paths outside --allow-fs-read. The earlier CVE-2026-21715 covered only fs.realpathSync.native(). Qualys tells readers not to treat the Permission Model as a security boundary on affected versions.
Three TLS hostname bugs that need specific resolvers
The TLS fixes share a theme: different parts of the stack parse an IPv4 address differently. CVE-2026-106069, rated High, concerns leading-zero addresses such as 0127.0.0.1, which WHATWG URL rules read as octal and some operating-system resolvers, macOS among them, read as decimal. A server can then authenticate with a certificate issued for a different IP.
CVE-2026-105483 covers fullwidth-digit IPv4 hosts and affects 24.x and 26.x. CVE-2026-106072, rated Medium, covers spellings such as 0x7f.0.0.1 and 127.1, and needs a certificate with a numeric DNS name from a trusted CA plus a resolver such as glibc. The advisory lists no workaround for any of the three.
The release also updates bundled CA certificates for the eMudhra intermediate compromise reported in Eight eMudhra CA Keys Could Be Computed From Public Certificates, plus c-ares, OpenSSL, SQLite and Undici.
- End-of-life or unsupported lines1.7 million
- Supported lines, fix not yet applied1.3 million
- Patched0.04 million
Source: Qualys blog, Oct. 23, 2026 (updated Oct. 27), accessed 2026-10-27
Half of installs will never get these fixes
Qualys found 3.3 million Node.js package installations, 15 percent on internet-facing assets. About 1.7 million run end-of-life or unsupported lines, and 1.3 million run supported lines without the fix. Only 42,000 were patched. These are Qualys customer figures, not a census.
Releases 25.x, 23.x and 21.x get no fix, and 20.x and older are end of life, so those users must move to 22, 24 or 26. After upgrading, restart long-running services, containers and single-executable applications, because they keep the old runtime in memory. For another disclosure with a dated upstream timeline, see Cloudflare's GLM 5.3 exposure.
Sources
More in Security
- 01A Tampered Claude Code Extension Sat in Cursor's Marketplace for 11 Hours and Left an SSH Key BehindVersions 2.1.312 and 2.1.313 carried a 7,386-byte loader that plants an attacker key and a reverse tunnel. Uninstalling the extension does not remove either.
- 02Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.
- 03Alpine Logged GitLab CVE-2026-97229 Attacks Nine Days Before CISA Listed ItAlpine's incident report shows the CVSS 10.0 flaw was exploited against its own server on Oct. 20 and 21, and that two GitLab 19.3 builds it ran still carried the bug.
- 04KPMG Could Not Confirm the Deepfake in Capillary's €3 Million FraudCapillary Technologies blamed deepfake cloning in July, but the forensic audit it filed on Oct. 31 calls the loss a payment-diversion scam and says the missing recordings and phone data leave deepfakes unproven.