# Node.js Patches High-Severity Brotli RCE Flaw (CVSS 9.2) Among 10 CVEs

URL: https://edufabtech.com/news/nodejs-october-2026-security-release-brotli-rce  
Section: News · Technology  
Published: 2026-10-23  
Publisher: EduFabTech (https://edufabtech.com)

> Node.js shipped v26.12.1, v24.22.1 and v22.23.4 on 21 October 2026, fixing a high-severity Brotli decoder flaw scored 9.2 on CVSS 4.0 by independent researchers, and nine other vulnerabilities, including TLS hostname bypasses.

The Node.js project released security updates for all three of its active release lines on Wednesday, 21 October 2026, patching ten vulnerabilities, four of them rated high severity. The headline fix closes a high-severity out-of-bounds write in Node's bundled Brotli decoder, tracked as **CVE-2026-111497**, which the Node.js project's advisory describes as permitting remote code execution. The patched releases are v26.12.1, v24.22.1 and v22.23.4; the advisory notes that end-of-life release lines, which include Node.js 20.x, are always affected by a security release but do not receive a fix.

The flaw sits in code every Node.js application can reach without realizing it. Node's built-in `fetch()` decompresses responses sent with a `Content-Encoding: br` header by default, and the `node:zlib` module exposes the same decoder directly. A security writeup from Strix scores CVE-2026-111497 at 9.2 out of 10 on the CVSS 4.0 scale — within the "critical" band of that scoring system even though Node.js's own advisory lists the issue as "high" — and classifies it under CWE-787 (out-of-bounds write) and CWE-252 (unchecked return value), describing the bug as a buffer overflow that lets a remote, unauthenticated attacker "corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream."

For students and developers, the practical lesson is less about Node.js itself and more about where the bug actually lives. The decoder is vendored C++ code from Google's Brotli library, not something the Node.js core team wrote. Strix's writeup places the vulnerable range at Brotli versions 1.0.3 up to but not including 1.0.10, 1.1.0 up to 1.1.1, and 1.2.0 up to 1.2.1 — Node.js inherited the bug by bundling an older copy of that library, the same pattern that has repeatedly turned compression and parsing libraries into a soft underbelly of otherwise well-maintained runtimes.

![A severity ladder sorts all 10 patched CVEs into Low/Medium/High buckets, with a red callout flagging that independent researchers score the Brotli RCE as Critical even though Node's own advisory calls it High.](https://edufabtech.com/uploads/2026/10/nodejs-october-2026-security-release-brotli-rce-2.png)
*A severity ladder sorts all 10 patched CVEs into Low/Medium/High buckets, with a red callout flagging that independent researchers score the Brotli RCE as Critical even though Node's own advisory calls it High. — EduFabTech · Own work*

Independent security coverage reached the same conclusion about exposure. A writeup from Astra Security lists CVE-2026-111497 as the headline issue of the release and places the attack surface at any application that decompresses attacker-controlled Brotli data, including HTTP requests carrying a `Content-Encoding: br` header and WebSocket frames using Brotli compression. That framing matters for anyone running a Node.js-based API, since a server does not need to call any unusual function to be exposed — ordinary request-body parsing is enough if Brotli decompression is enabled.

## The other nine fixes in the same release

The release bundles several lower-profile but still notable issues, according to the Node.js advisory:

| CVE | Severity | Issue |
| --- | --- | --- |
| CVE-2026-105482 | High | dns.resolve truncates names containing a NUL character |
| CVE-2026-105483 | High | TLS certificate hostname bypass when an IP is written with fullwidth digits |
| CVE-2026-106069 | High | TLS certificate hostname bypass when a hostname loosely resolves to an IP address |
| CVE-2026-105481 | Medium | A keep-alive socket can process a response written before its request was sent |
| CVE-2026-106072 | Medium | Improper validation of non-canonical IPv4 hostnames lets DNS-based certificates authenticate IP endpoints |
| CVE-2026-106074 | Medium | crypto.randomUUID() and randomInt() entropy caches get saved into startup snapshots, so every process repeats the same values |
| CVE-2026-106070 | Low | Node's ZipFile handling returns attacker-controlled prefix bytes after a failed ZIP header check |
| CVE-2026-106071 | Low | Permission Model filesystem over-grant via wildcard radix lookup |
| CVE-2026-106073 | Low | Permission Model bypass using fs.realpathSync |

The three TLS-related entries are worth pausing on for anyone studying network security: each describes a different way a certificate's hostname check can be tricked into matching an IP address it should not match, whether through fullwidth Unicode digits or loose hostname-to-IP resolution. Taken together with the Brotli flaw, the release is a reminder that runtime security bugs cluster around the places where untrusted input meets parsing code — compression streams, certificate strings, DNS responses — rather than around application logic.

![A four-step flow shows how an ordinary Brotli-compressed HTTP or WebSocket response travels through fetch()/node:zlib into the vulnerable native decoder and out the other side as RCE, memory leak, or denial of service.](https://edufabtech.com/uploads/2026/10/nodejs-october-2026-security-release-brotli-rce-3.png)
*A four-step flow shows how an ordinary Brotli-compressed HTTP or WebSocket response travels through fetch()/node:zlib into the vulnerable native decoder and out the other side as RCE, memory leak, or denial of service. — EduFabTech · Own work*

## What to do, and why the deadline is now

The Node.js advisory also lists a dependency update addressing a compromised eMudhra intermediate certificate authority as part of the same release, alongside updates to c-ares, OpenSSL, SQLite and Undici — a reminder that a runtime's dependency tree, not just its own code, is part of what a security release has to cover. None of that changes the urgency of the headline fix: because the Brotli decoder runs as native code inside the Node.js process, a successful exploit is not limited by JavaScript's own memory safety guarantees.

For anyone running a Node.js service in production, the advisory's instruction is unambiguous: update to v26.12.1, v24.22.1 or v22.23.4 depending on which line is in use, and audit whether any code path decompresses Brotli data from an untrusted source in the meantime. Projects still on Node.js 20.x or earlier receive no patch and should treat migration to a supported line as the only fix available.

## Sources

1. Node.js Project. (2026). Node.js — Wednesday, October 21, 2026 Security Releases. Node.js Foundation https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
2. Strix. (2026). CVE-2026-111497: Brotli Out-of-Bounds Write (CVSS 9.2). Strix https://www.strix.ai/cve/CVE-2026-111497
3. Astra Security. (2026). Node.js October 2026 Security Release: Brotli RCE + 9 CVEs. Astra Security https://www.getastra.com/blog/security-advisory/nodejs-october-2026-security-patches/

---
Source page: https://edufabtech.com/news/nodejs-october-2026-security-release-brotli-rce  
Quote with a link to the source page. © EduFabTech.