Node.js Fixes Four High-Severity Security Flaws

Node.js users have three new versions to install. On Wednesday the project shipped updates for all three release lines it is patching, the 22.23.4 and 24.22.1 long-term support releases and 26.12.1 on the Current line, fixing ten vulnerabilities, four of which it rates high.

The most serious, by its own description, is CVE-2026-111497: a “Node.js Brotli decoder out-of-bounds write” that “permits remote code execution”. It affects the 22.x, 24.x and 26.x lines. The project’s advisory rates it high, not critical, and says “the highest severity issue fixed in this release is HIGH”. It does not report any exploitation, and gives no CVSS scores.

Two of the high-rated bugs undermine certificate checks

The other three high-severity flaws concern how Node.js checks who it is talking to. CVE-2026-105483 is a “TLS certificate hostname bypass when the IP is written fullwidth digits”, affecting 24.x and 26.x. CVE-2026-106069, a “TLS certificate hostname bypass when the host loosely resolves to an IP address”, affects all three lines. TechCrunch notes that the two TLS bugs could let attackers get around checks meant to verify a server’s identity.

The fourth, CVE-2026-105482, means “dns.resolve truncates names containing NUL char”, again in every supported line.

Three further flaws are rated medium. One involves a keep-alive socket processing a response written before the request was sent; another, improper certificate validation for non-canonical IPv4 hostnames. The third affects crypto.randomUUID() and randomInt(): their entropy caches can be saved into user-land startup snapshots and SEAs, “so every process repeats the same values”. Three low-rated issues cover a ZipFile bug and two weaknesses in Node.js’s Permission Model.

Alongside its own fixes, the release updates several bundled dependencies “to address public vulnerabilities”: c-ares and Undici on all three lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x. The list also includes a “ca-cert” update on every line, labelled “eMudhra Intermediate CA Compromise”, which follows Mozilla’s report this week that keys to eight eMudhra intermediate certificates had been compromised.

The advisory thanks, by username, the people who reported and fixed each issue. The Brotli bug was reported by mcollina and fixed by aduh95. A reporter named as hasanfleyah found both the NUL-character DNS bug and the fullwidth-digit TLS bypass, which jasnell fixed, while anagnorisis2peripeteia reported the loose-resolution bypass, fixed by mcollina.

TechCrunch grouped the Node.js release with the PHP2Shell fixes and a malicious LiteLLM release on PyPI under the headline “The internet is having a very bad cybersecurity day”.

Older versions get no fix

The advice is to update. Developers and operators running Node.js 22, 24 or 26 should move to 22.23.4, 24.22.1 or 26.12.1. Anyone on an older line has a harder job: the advisory warns that “End-of-Life versions are always affected when a security release occurs”, so upgrading to a supported line is the only route to these fixes.