Node.js Patches 10 Flaws Including Brotli RCE, Blocks eMudhra Keys

Node.js, the JavaScript runtime behind a large number of websites, apps and developer tools, released security updates on Wednesday, 21 October, for its 26.x, 24.x and 22.x lines, fixing 10 vulnerabilities. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that the project says permits remote code execution. The same release updates Node’s bundled list of trusted certificates to deal with the compromised eMudhra certificate authority keys.

Four High-Rated Bugs, Two in Certificate Checks

Four of the 10 flaws are rated high. Besides the Brotli bug, CVE-2026-105483 and CVE-2026-106069 let an attacker get past the check that a TLS certificate matches the host name, in one case by writing an IP address in fullwidth digits. CVE-2026-105482 causes dns.resolve to cut short names that contain a NUL character.

Three bugs are rated medium. One makes crypto.randomUUID() and randomInt() repeat the same values in every process when apps are built from startup snapshots or as single executable applications. The other medium and low bugs affect keep-alive connections, IP address checks in certificates, ZIP handling and the Permission Model.

Upgrade to 26.12.1, 24.22.1 or 22.23.4

The fixed versions are Node.js 26.12.1, 24.22.1 and 22.23.4. Versions that have reached end of life get no fix, and the project advises moving to a supported line. Node.js did not publish severity scores for the bugs, and Cyber Kendra reported no known exploitation. The Brotli flaw was reported by Matteo Collina and fixed by Antoine du Hamel.

The release also updates c-ares, OpenSSL, SQLite and Undici, libraries that Node.js depends on.

Why the eMudhra Change Matters for Node Apps

Browsers blocked the eight compromised eMudhra intermediate certificates between 17 and 20 October, but server software often carries its own list of trusted authorities. Security researcher Scott Helme said his tests showed Node.js, curl, Python, Go and Java accepted a forged certificate made with one of the eMudhra keys. Developers who run Node.js on servers need this release, or the matching update from their Linux distribution, to stop trusting those keys.

Read IPB’s report on the eMudhra key compromise and our detailed explainer. Also fixed on the same day: two critical PHP flaws.

Source: Node.js October 2026 security releases. Also based on reporting by Cyber Kendra and CoinDesk.

Image: Cyber Kendra.