Skip to contentistheinternetok
All incidents

Security flaw·Major

Node.js: four high severity flaws fixed

Fix availableAffects developers
Node.js

What it changes for you

Nothing visible for you; developers must update Node.js.

Node.js, which runs the server side of many websites and apps, fixed 10 flaws, including one in its Brotli decompression that could let attacker data run code. Visitors have nothing to do; developers should update Node.js.

Started Oct 21, 2026Updated Oct 21, 2026

Post on X

What should I do?

You
Nothing to do.
If you run a website or an app
Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4, and rebuild Docker images and single executable apps on the fixed version. End-of-life versions get no fix.

What is affected

CVE-2026-111497CVE-2026-105482CVE-2026-105483CVE-2026-106069

Timeline

  1. Fix available · Oct 21, 2026

    Node.js releases 26.12.1, 24.22.1 and 22.23.4 fixing 10 vulnerabilities (4 high, 3 medium, 3 low), including a Brotli decoder out-of-bounds write that permits remote code execution (CVE-2026-111497) and TLS hostname check bypasses.

    nodejs.org

Sources

Related