A compressed file shouldn't be able to take control of your server. In Node.js, a flaw in the built-in Brotli decoder made that possible in the worst case. The Node.js project fixed it on October 21, 2026, along with nine other vulnerabilities in the same release.
The Brotli bug, credited to OpenAI's Codex Security tool, lets a malicious compressed payload write past the end of a memory buffer inside Node's own decoder. That can mean a crash, leaked memory, or remote code execution on your server.
If your company runs Node.js anywhere (an API, a Next.js storefront, a build pipeline, a Lambda function), this one's for you. The bug doesn't live in your code or in an npm package. It ships inside the runtime.
Here's the good news. Patched versions exist for every supported line, and the official advisory rates the worst issue High, not Critical. Here's the less good news. Node.js 20 and older won't get a fix, and a separate pair of critical Next.js flaws landed a week earlier.
We've pulled together what's confirmed, what isn't, and what to do this week. You'll get the fixed version numbers, a seven-step patch plan, and a straight answer if you're stuck on an older release.
Quick Answer: Node.js fixed 10 vulnerabilities on October 21, 2026, including CVE-2026-111497, a Brotli decoder flaw that can lead to remote code execution. Upgrade to Node.js 26.12.1, 24.22.1, or 22.23.4, then rebuild your containers and restart your services. Node.js 20 and older get no fix.
What is the Node.js October 2026 security release? It's a coordinated set of fixes for 10 CVEs across the 26.x, 24.x, and 22.x release lines. Four are rated High, three Medium, and three Low. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder inside the node:zlib module. Others weaken DNS and TLS hostname checks, which can let an attacker pass off one host as another.
Key Takeaways:
- Patch the runtime itself. Install Node.js 26.12.1, 24.22.1, or 22.23.4. Updating npm packages won't close these flaws, because they live inside Node.js.
- The Brotli bug is the headline. Untrusted Brotli data can corrupt memory, leak data, or run code. Exposure depends on whether your app decompresses data from outside sources.
- TLS and DNS bugs deserve attention too. Three High-severity flaws can fool hostname checks, which matters if you rely on Node.js to verify who you're talking to.
- Node.js 20 is out of support. It reached end of life on April 30, 2026, so it won't receive these fixes.
- Next.js needs its own update. Two critical remote code execution flaws were fixed in Next.js 16.4.1 and 15.5.28 on October 14.
Local Expertise: Running Node.js in production in the US now means treating runtime updates like any other security task. Syndell Technologies, headquartered in Middletown, Delaware, supports businesses across the USA, UK, UAE, Canada, Australia, and India with backend development, cloud migration, and custom application development, backed by 1,100+ delivered projects in 20+ countries.
Table of Contents (11 min read)
- What Node.js Fixed on October 21
- Are Your Node.js Apps Exposed?
- The Brotli Flaw, Explained Without the Jargon
- What We Know About Exploitation
- How to Fix the Node.js Vulnerabilities in 7 Steps
- Don't Skip the Next.js Update
- The Bigger Risk: Node.js Versions Nobody Supports
- Five Questions to Ask Your Team This Week
- Is Node.js Still a Safe Bet?
- Frequently Asked Questions
What Node.js Fixed on October 21
The Node.js team published its October 2026 security releases on October 21. That's the same day PHP shipped its emergency PHP2Shell patches, so many teams are now patching two runtimes at once. (If you missed the PHP side, our PHP2Shell patch guide covers it.)
Node.js lists no Critical issues. Four are High, three Medium, and three Low. Checkmarx, a security vendor, rates the Brotli flaw Critical instead of High, so you'll see both labels in the wild. Either way, the advice doesn't change: upgrade.
The release also updates bundled dependencies, including c-ares, OpenSSL, Undici, SQLite, and a certificate store update tied to the eMudhra intermediate CA compromise.
| CVE | Severity | Component | What it does |
|---|---|---|---|
| CVE-2026-111497 | High (RCE) | Brotli decoder (node:zlib) | Out-of-bounds write that can crash, leak memory, or run code |
| CVE-2026-105482 | High | DNS (dns.resolve) | Hostnames with NUL bytes get truncated, so a fake host resolves as a trusted one |
| CVE-2026-105483 | High | TLS hostname check | Fullwidth-digit IP addresses slip past IP detection |
| CVE-2026-106069 | High | TLS hostname check | Leading-zero IPv4 addresses are read differently by Node.js and the operating system |
| CVE-2026-105481 | Medium | HTTP keep-alive | A stray response can be accepted as the answer to a different request |
| CVE-2026-106072 | Medium | TLS hostname check | Odd IPv4 spellings are matched against DNS names in certificates |
| CVE-2026-106074 | Medium | crypto (randomUUID, randomInt) | Snapshots and single executable apps can repeat “random” values |
| CVE-2026-106070 | Low | zlib.ZipFile | A failed header check can return bytes from the start of the file |
| CVE-2026-106071 | Low | Permission Model | A wildcard grant can match a shorter path than intended |
| CVE-2026-106073 | Low | Permission Model | fs.realpathSync lets restricted code probe paths outside its allowed folders |
Are Your Node.js Apps Exposed?
Short answer: if you run Node.js 26, 24, or 22 below the fixed releases, yes, you're running code with known flaws. Whether an attacker can reach them depends on what your app does.
The official page gives no workarounds, only upgrades. Here are the fixed versions.
| Release line | First fixed in | Active LTS release (includes the fix) | Support status |
|---|---|---|---|
| Node.js 26 | 26.12.1 | 26.13.0 | Active LTS since October 28, EOL April 30, 2029 |
| Node.js 24 | 24.22.1 | 24.22.2 | Active LTS, EOL April 30, 2028 |
| Node.js 22 | 22.23.4 | 22.23.4 | Supported, EOL April 30, 2027 |
| Node.js 20 and older | No fix | No fix | End of life (Node.js 20 ended April 30, 2026) |
One detail trips people up. CVE-2026-105483 (the fullwidth-digit TLS bug) affects only the 26.x and 24.x lines, so 22.x isn't listed for that one. You'll still want 22.23.4 for the other nine.
Which Node.js versions fix CVE-2026-111497?
Node.js 26.12.1, 24.22.1, and 22.23.4 contain the fix, all released October 21, 2026. Earlier releases in those lines are still exposed. Node.js 20 and older receive no fix, because they've passed end of life. If you can't upgrade today, plan to move to a supported line quickly, since the official advisory offers no workaround.
Does this affect Docker containers and serverless apps?
Yes. A container ships its own Node.js, so updating the host does nothing for it. Rebuild from an updated node image tag and redeploy. For serverless platforms such as AWS Lambda, Vercel, Netlify, and Cloudflare Workers, check that the provider has updated its runtime. Astra's advisory summary recommends confirming this with your vendor rather than assuming it.
The Brotli Flaw, Explained Without the Jargon
Brotli is a compression format. Browsers and servers use it to shrink web traffic, and Node.js includes a decoder for it in node:zlib.
Here's what went wrong. When the decoder met an invalid block switch, it treated that as “I need more input” and kept writing into an 8-byte buffer. That can overflow the buffer. An attacker who controls the compressed data can potentially crash the process, read memory they shouldn't, or run their own code.
Where does that data come from? According to Astra's analysis, the exposure includes:
- HTTP request bodies sent with a Content-Encoding: br header
- Responses your app fetches with fetch() from a hostile or compromised server
- WebSocket frames that use Brotli compression
Read that list again. The third one surprises people. You don't have to call a Brotli function in your own code for a library you depend on to do it for you.
Our read: if your Node.js app never decompresses data from outside sources, your practical risk is lower. But most apps call external APIs, and you rarely know every library's compression habits. Patch anyway.
Is CVE-2026-111497 being exploited in the wild?
Not according to what we've found. The official Node.js page gives no exploitation status, and Astra's write-up states that no in-the-wild exploitation has been reported yet. That can change fast once exploit details circulate. Treat the gap between disclosure and the first public exploit as your patching window, not as proof you're safe.
Who found the Brotli bug?
The Node.js advisory credits OpenAI Codex Security, specifically researchers Khai Tran and Sylvie Mayer. That's notable. An AI-driven security tool found a memory-safety bug in a mature, widely used decoder. Our view: attackers can use similar tools, so expect disclosures like this to keep coming and plan for faster patch cycles.
Not Sure Which Node.js Version Your Apps Run?
We inventory every Node.js server, container, and serverless function you operate, then map a patch plan before attackers find the gaps you missed.
Schedule Your Node.js Security Review.
What We Know About Exploitation
Let's separate confirmed from claimed.
Confirmed:
- Node.js released fixes for all 10 CVEs on October 21, 2026, across 26.x, 24.x, and 22.x.
- Astra reports no in-the-wild exploitation as of its write-up.
- CVE-2026-106072 has a stated precondition: a certificate with a numeric DNS name from a trusted certificate authority, plus a resolver that accepts these spellings.
Not established:
- Any public proof-of-concept exploit for the Brotli bug. We haven't found one in the sources we reviewed.
- A CVSS score for the Brotli flaw. Astra gives severity labels only, and the official page does too.
- Whether any attacker is scanning for it yet. We don't know, and neither does anyone who's honest about it.
So what's the practical read? You've got a short window. TLS hostname-bypass bugs and an RCE in a widely deployed runtime are exactly what researchers (and attackers) dissect first.
How to Fix the Node.js Vulnerabilities in 7 Steps
Here's the sequence we'd follow, whether you run one service or fifty. Start with whatever faces the internet.
- Inventory every Node.js runtime. Count production servers, staging, containers, CI images, serverless functions, and any single executable apps (SEAs) you've built. Forgotten services are where trouble starts.
- Check the real version. Run node –version inside each environment, not on your laptop. A container can run a different Node.js than the machine hosting it.
- Upgrade to a fixed release. Move to 26.12.1, 24.22.1, or 22.23.4. For containers, rebuild from an updated node image tag and redeploy.
- Rebuild SEA binaries and snapshots. If you built single executable apps or startup snapshots on a vulnerable version, rebuild them with the patched binary. Regenerate any keys, tokens, or IDs they created, because CVE-2026-106074 can repeat “random” values.
- Restart everything. Restart your services so every process loads the patched runtime. A package update without a restart changes nothing.
- Confirm managed platforms. Check that AWS Lambda, Vercel, Netlify, Cloudflare Workers, or your host has applied the update. Ask in writing if the status page is vague.
- Review TLS pinning and logs. If your code leans on Node.js's built-in hostname verification, audit it. Look for odd Content-Encoding: br requests, unusual outbound connections, and crashes since October 21.
# Check the runtime version (run inside each container or host)
node --version
# Check a container image before you deploy it
docker run --rm node:24.22.1 node --version
# Find Brotli and compression usage in your own code
grep -rn "brotli|Content-Encoding" ./src
# Check which Next.js version a project uses
npm ls nextHow do I check my Node.js version?
Run node –version in the exact environment where your app runs. For Docker, run it inside the container or check your image tag. Compare the result with the fixed releases: 26.12.1, 24.22.1, or 22.23.4. If your number is lower inside the same line, you're exposed. Serverless users should check the runtime setting in their platform dashboard.
Are there interim mitigations if I can't patch today?
Astra suggests a few stopgaps, and they're not official Node.js guidance: strip or block untrusted Content-Encoding: br headers, check hostnames for NUL bytes before dns.resolve, pin certificates for sensitive TLS connections, and don't treat the Permission Model as a security boundary. These reduce exposure but don't replace the upgrade. Schedule the real fix.
Running Next.js in Production?
We check your Node.js runtime and your Next.js version together, so one patch doesn't leave the other gap open.
Get Your Next.js Patch Check.
Don't Skip the Next.js Update
Here's the part that gets missed. A week before the Node.js release, on October 14, the Next.js team published an out-of-band security update. It fixes two critical remote code execution flaws, and the patched versions are Next.js 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS).
| Issue | Severity | Who's affected |
|---|---|---|
| Unauthenticated RCE in use cache functions that return typed arrays (GHSA-673q-mjm6-r5xr) | Critical | App Router apps using Cache Components. No known workaround |
| Unauthenticated RCE in Image Optimization with SVG (CVE-2026-96889) | Critical | Next.js running on glibc-based Linux. Workaround: sharp 0.35.5 or later |
| Denial of service in Server Actions (GHSA-p3m5-59mp-jv5r) | High | App Router apps with at least one Server Action. Pages Router isn't affected |
The Next.js team says to upgrade immediately even if your app doesn't have similar functions. Run these:
npm install [email protected] # for the 16.4 line
npm install [email protected] # for the 15.5 line
A Next.js app can sit on a vulnerable Node.js runtime and a vulnerable framework at the same time. Fix both. Fixing one doesn't cover the other.The Bigger Risk: Node.js Versions Nobody Supports
Node.js 20 reached end of life on April 30, 2026, according to endoflife.date. It received no fixes in this release. If you're still running it, every flaw above stays open, and so will every flaw found after it.
Here's the calendar worth putting on a whiteboard:
| Node.js line | Security support ends |
|---|---|
| 20 | April 30, 2026 (already ended) |
| 22 | April 30, 2027 |
| 24 | April 30, 2028 |
| 26 | April 30, 2029 |
Node.js is also changing its release rhythm. The project is moving to one major release a year, starting with Node.js 27 (alpha in October 2026, long-term support in October 2027). That should make upgrade planning simpler. It doesn't excuse standing still.
Our view? If you're on Node.js 20 or older, move to 24 or 26 this quarter. Don't wait for the next advisory to force the decision. Upgrading a year late costs more than upgrading on schedule, because dependencies, build tools, and frameworks all drift.
| Approach | Best when | Trade-off |
|---|---|---|
| Patch in place | You're on a supported line (22, 24, 26) | Fast, but doesn't fix aging code or dependencies |
| Upgrade to a supported line | You're on Node.js 20 or older, and the app is mostly current | Needs testing and dependency updates |
| Modernize or rebuild | The app is years old, poorly tested, or hard to change | Bigger project, longer-term payoff |
Still on Node.js 20 or Older?
Whether you need a quick move to Node.js 24 this month or a bigger modernization this quarter, we plan and deliver the upgrade for you.
Schedule Your Consultation.
Five Questions to Ask Your Team This Week
You don't need to read memory dumps to lead through this. You need clear answers. Put these to your IT or engineering lead:
- Do we have a current list of every Node.js runtime we operate, including containers, CI images, and serverless functions?
- Who owns runtime updates, and how many hours does it take to ship an emergency one?
- Are our managed platforms confirmed as patched, or are we assuming?
- Do any of our apps run Node.js 20 or older, or a Next.js version below 16.4.1 or 15.5.28?
- Do we rely on Node.js's built-in hostname checks for anything sensitive, such as payment or partner connections?
Vague answers are an answer. If nobody can say what's running where, that's your first project.
Is Node.js Still a Safe Bet?
Yes, with discipline. We've delivered 1,100+ projects across 20+ countries, and one lesson repeats: platform choice matters less than patch habits. PHP had its critical week. Node.js is having its own. Every major runtime has shipped serious bugs, and the ones that hurt are the ones nobody updates.
So don't rip out Node.js in a panic. A patchable flaw rarely justifies rebuilding a working application. But do use this moment to retire unsupported versions and name an owner for runtime updates.
If you're weighing Node.js against other options for a new build, our guide to the best backend technologies for web development is a useful starting point. And if an older system is holding you back, Syndell's guide on how to plan legacy software modernization shows where to start. Need extra hands for the upgrade work? You can hire dedicated developers who join your team quickly.
Conclusion
This Node.js security update is a patch-now problem with a clear fix. Upgrade to Node.js 26.12.1, 24.22.1, or 22.23.4, rebuild your containers, restart your services, and update Next.js to 16.4.1 or 15.5.28 if you use it. If you're on Node.js 20 or older, a move to a supported line is the real answer.
Why does this matter beyond one round of patching? Because two major runtimes shipped critical fixes within days of each other, and AI-assisted tools are helping researchers find bugs faster. The teams that cope best aren't the ones with the cleverest code. They're the ones who know what they run, who owns the update, and how fast they can ship it.
Here's the order we'd work in. Today: inventory your Node.js runtimes and confirm versions. This week: patch, rebuild, restart, and verify. This quarter: plan the move off any unsupported version.
You don't have to do it alone. Syndell Technologies helps businesses across the US modernize legacy applications, migrate them to the cloud, and build faster, safer replacements through our custom software development team and software development company in the USA services.
Ready to get your Node.js stack on solid ground? Schedule a meeting with Syndell Technologies, or get an estimate for your upgrade. No obligation, and you'll leave with a clear plan.
