L4 · Septic Tank BlewNode.js · TLS · RCEnodejs-oct-2026

Node.js: a Brotli RCE and two ways to fool TLS hostname checks

Node.js October security releases for 22, 24 and 26: ten CVEs, including a Brotli RCE and TLS hostname bypasses

Four HIGH, three MEDIUM and three LOW. An out-of-bounds write in the Brotli decoder, dns.resolve truncating names at a NUL byte, and IP spellings that sneak past certificate hostname checks. The release also rejects the compromised eMudhra keys.

Disclosed: Oct 21, 2026; Public disclosure date
Severity: Septic Tank Blew; 10 CVEs tracked here
Splash zone: Node.js 22.x, 24.x, 26.x and every end-of-life line; node
In the wild: Not applicable; No exploitation reported

The one-sentence version

Send a server a crafted Brotli-compressed body and it writes past a buffer; or present a certificate for an IP written in a weird way and Node may accept it for a host it does not belong to.

What happened

A routine-looking security release with a few nasty pieces. The headline item is an out-of-bounds write in the Brotli decoder (CVE-2026-111497). Anything that decompresses untrusted Brotli data, such as HTTP bodies, uploads or proxied responses, should treat this as a remote code execution risk.

Two separate bugs (CVE-2026-105483 and CVE-2026-106069) let unusual IP spellings pass TLS hostname verification. That is the check that makes sure the certificate actually belongs to the server you meant to reach.

The same release ships a ca-cert update that rejects TLS chains containing the compromised eMudhra keys. See the eMudhra incident. Already-resumed TLS sessions are not re-checked, so restart services after upgrading.

We grade it L4. It is a core runtime with a remotely reachable memory bug, but there is no exploitation in the wild yet.

What’s in the bowl

CVE-2026-111497

Brotli decoder out-of-bounds write

Decompressing attacker-controlled Brotli data can write out of bounds, leading to possible code execution.

In plain poop: someone flushes a brick, and the pipes burst into your server room.

CVE-2026-105482

dns.resolve truncates at NUL

Hostnames containing a NUL byte are cut short, so the name you check is not the name you resolve.

CVE-2026-105483

Fullwidth-digit IP hostname bypass

An IP address written with fullwidth digits can pass TLS hostname verification. Affects 24.x and 26.x only.

CVE-2026-106069

Loose IP resolution hostname bypass

Hosts that loosely resolve to an IP address can slip past TLS hostname checks. Affects all three lines.

CVE-2026-105481

Premature keep-alive response

A keep-alive socket can process a response written before its request was sent. Affects 22.x, 24.x and 26.x.

CVE-2026-106072

Non-canonical IPv4 certificate validation

DNS SANs can authenticate IP endpoints through non-canonical IPv4 hostnames. Affects 22.x, 24.x and 26.x.

CVE-2026-106074

Repeated entropy after startup snapshots

Startup snapshots and SEAs preserve randomUUID and randomInt entropy caches, repeating values across processes. Affects 22.x, 24.x and 26.x.

CVE-2026-106070

Invalid ZIP header prefix returned

ZipFile can return attacker-controlled prefix bytes after header validation fails. Affects 26.x.

CVE-2026-106071

Filesystem wildcard permission over-grant

Wildcard radix lookup can grant excessive filesystem permissions. Affects 26.x.

CVE-2026-106073

realpathSync permission bypass

fs.realpathSync can bypass the Permission Model. Affects 22.x, 24.x and 26.x.

Are you standing in it?

Run node -v on each box, then type the version or pick the closest match.

Fixed versions (Oct 21, 2026)
Branch	Safe from	Status
Node.js 26	`26.12.1`	Current
Node.js 24	`24.22.1`	Active LTS
Node.js 22	`22.23.4`	Maintenance LTS
Node.js 20 and older	`none`	End of life, affected, no fix

Crime-scene timeline

Oct 21, 2026
Node.js ships security releases for 22, 24 and 26
Ten CVEs in total, plus dependency bumps for c-ares, ca-cert, OpenSSL (22/24), SQLite (22) and Undici.
Oct 21, 2026
Bundled CA store updated to NSS 3.131.1
TLS chains that contain the eight compromised eMudhra keys are now rejected.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Node.js blogPrimaryOfficial advisory with all ten CVEs and fixed versions
Vercel KBPlatform guidance; notes resumed TLS sessions are not re-verified