Node.js Security Releases: One Batch of Version Numbers, Two Security Lists
On October 21 (early morning Beijing time), Node.js released security updates for all three of its version lines at once: v22.23.4, v24.22.1, and v26.12.1, patching ten CVEs — four high, three medium, three low. These version numbers should look familiar: earlier that morning, eMudhra's remediation tracker listed the exact same three releases. One set of version numbers doing two jobs: replacing the trust store after a compromised CA, and fixing ten holes in the runtime itself.
The worst one: out-of-bounds write in Brotli
The most severe issue lives in the Brotli decoder (CVE-2026-111497, affecting all three lines). Brotli is Google's compression algorithm, commonly used for web pages and API response bodies. Node embeds its C decoder — so any service that decompresses attacker-supplied Brotli payloads is exposed. Out-of-bounds write is the heaviest class of memory-safety bug: write to the wrong place and remote code execution is one step away. The official advisory puts RCE directly in the title. Notably, Node didn't write its own fix; it cherry-picked the upstream author's patch from the Google brotli repository. An error code exposed alongside the patch (BLOCK_SWITCH) hints the bug hides in Brotli's dynamic block-switching code path. The discoverer, mcollina, is a member of Node's Technical Steering Committee — an insider finding flaws in their own codebase.
Three certificate-validation bugs, one disease
CVE-2026-105483, CVE-2026-106069, and CVE-2026-106072 are three variants of the same problem. TLS validation hinges on a preliminary question: is your connection target an IP address or a domain name? The two are validated differently — IPs must match the certificate's iPAddress field, while domains match DNS names. The trouble is that Node's code deciding "is this an IP" is not the same parser that establishes the connection. The same string can be read two ways: a full-width-digit "１２７．０．０．１" is treated as a domain by the validator (it's not a canonical IP format) but normalized to 127.0.0.1 by the connection layer. Shorthand like "127.1" and hexadecimal like "0x7f.1" work the same way — validated as domains, connected to as IPs. An attacker with an ordinary domain certificate can impersonate an IP endpoint. The full-width-digit bug is also a regression: this area was fixed once before and crept back from elsewhere.
NUL bytes in dns.resolve
CVE-2026-105482 is old wine in a new bottle: hide a NUL byte inside a hostname, and the application-level check sees a different name than the C-layer resolver reads — C strings truncate at NUL, so the first half passes your allowlist while the second half is what actually gets resolved. SSRF bypasses have fed on this for decades.
Entropy baked into single-executable snapshots
The most imaginative bug is the entropy one (CVE-2026-106074). Node supports embedding a startup snapshot into a single-file executable (SEA) for faster startup — essentially serializing initialization state into the binary. But crypto.randomUUID() and randomInt() cache a batch of random entropy for performance, and that cache got baked into the snapshot too. Result: every process started from the same binary emits the same sequence of UUIDs and random numbers. The hand that optimized startup speed also optimized away "unpredictable." Any program using UUIDs as session tokens, verification codes, or resource identifiers becomes guessable.
The remaining three
- CVE-2026-105481: keep-alive connections can hand a response written before the previous request was even sent to the next request (cross-request response confusion).
- ZIP prefix injection (26.x): after a ZIP file header check fails, attacker-controlled prefix bytes are returned.
- Permission model wildcard path authorization bypass (26.x) and fs.realpathSync bypass (CVE-2026-106073) — don't be misled by the "26.x only" framing; the official details show it affects all three lines.
Dependency updates
Alongside the fixes: c-ares 1.34.9, OpenSSL 3.5.9, undici 7.30.1, and the root certificate store refreshed to NSS 3.131.1 — precisely the NSS row on eMudhra's remediation list this morning. One Node upgrade settles two security lists.
What to do
Upgrade is three lines: 22.x to 22.23.4, 24.x to 24.22.1, 26.x to 26.12.1.