Node.js fixes 10 security flaws, including a decoder bug that could let attackers run code

Malformed compressed data can corrupt memory in Node.js and potentially let an attacker run code. The Node.js Project’s October 21 security release patches that flaw alongside nine others across three release lines. Updates are now available, with high-severity issues addressed in each branch—not just the newest version.

A decoder keeps writing when it should stop

The Brotli flaw, CVE-2026-111497, starts with an error-handling mistake in the bundled decompression code. An invalid block switch is treated as a temporary shortage of input rather than a permanent format error. The streaming decoder then keeps adding bytes to an internal buffer that holds only eight bytes, writing beyond its boundary.

Exploitation requires an attacker to supply Brotli data that an application decompresses through node:zlib. The resulting memory corruption can crash the process, expose its memory or enable remote code execution—running an attacker’s instructions. Node.js rates the flaw high severity and lists all three branches as affected.

The release lists these patched versions for download:

• Node.js 26.x: v26.12.1
• Node.js 24.x: v24.22.1
• Node.js 22.x: v22.23.4

The checked hostname can differ from the destination

Another high-severity flaw affects DNS, the system that resolves hostnames to addresses. A hostname containing a NUL byte is silently cut short by dns.resolve*() and dns.reverse(). An application can therefore approve one hostname against an allowed-domain list, then receive address records for a different name. The bug affects all three branches.

Two high-severity certificate-checking flaws involve unusual ways of writing IP addresses. On 26.x and 24.x, non-ASCII characters such as fullwidth digits can cause an IP address to be checked against certificate DNS names instead of its IP-address entries. A separate flaw affects all three branches: an address beginning with a zero can be interpreted differently by the certificate check and the operating system’s resolver, authenticating a connection using a certificate for another address.

These fixes also revisit earlier repairs. Node.js describes the DNS flaw as an incomplete fix and the fullwidth-digit certificate flaw as a regression after a previous fix. The medium-severity HTTP connection-reuse flaw likewise completes an earlier repair: under certain timing conditions, a client can accept a response that arrived before it sent its request.

Saved randomness and filesystem limits

A medium-severity flaw affects startup snapshots, which save state for later processes to load. If certain random-value functions run while a snapshot is built, their stored randomness can be preserved too. Processes launched from it can repeat up to 127 UUIDs and about 1,000 randomInt() values before the caches refill. Identifiers can collide, and observing one process can reveal values another will issue.

Two low-severity fixes tighten Node.js filesystem permissions. On 26.x, a wildcard grant can allow a shorter path it should exclude: permission for /etc/passwd.* can also permit /etc/passwd. Across all three branches, fs.realpathSync() lacks required read checks, allowing restricted code to discover paths and resolve symbolic links outside permitted directories.

The remaining fixes address another certificate-validation weakness and a ZIP-reading flaw. The latter affects 26.x and can make a scanner approve different content from what another ZIP implementation extracts. The release also updates dependencies, including c-ares, Undici and certificate material addressing the eMudhra intermediate certificate-authority compromise.