Threat reportVulnerabilityTL-2026-4075
Node.js October 2026 Security Releases Fix 10 Vulnerabilities Including Brotli Decoder RCE and TLS Hostname Verification Bypasses (CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-105482)
Node.js October 2026 Security Releases Fix 10 (TL-2026-4075), also tracked as Node.js October 2026 Security Releases, is a high-severity software vulnerability, first published 2026-10-21. It has no confirmed attribution, affects OpenJS Foundation Node.js, references 10 CVEs (CVE-2026-111497, CVE-2026-105483, CVE-2026-106069), maps to 3 MITRE ATT&CK techniques (T1190, T1203, T1557), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 10Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4075
- Threat ID
- TL-2026-4075
- Also known as
- Node.js October 2026 Security Releases
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, finance, government administration, health, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Node.js October 2026 Security Releases Fix 10
Malware and tooling: Node.js Permission Model (--permission)
How Node.js October 2026 Security Releases Fix 10 works
On 2026-10-21 the Node.js project shipped coordinated security releases 26.12.1, 24.22.1 and 22.23.4 fixing 10 vulnerabilities (4 High, 3 Medium, 3 Low). The High-severity set covers a Brotli decoder out-of-bounds write that permits remote code execution, two TLS certificate hostname verification bypasses and a dns.resolve NUL-truncation flaw. No exploitation in the wild, public PoC or attribution is reported.
The Node.js project published its "Wednesday, October 21, 2026 Security Releases" advisory alongside new releases v26.12.1 (Current), v24.22.1 (LTS) and v22.23.4 (LTS). Ten CVEs are fixed: four rated High, three Medium and three Low. Affected lines are 26.x, 24.x and 22.x, although individual CVEs only affect a subset of lines.
High severity: (1) CVE-2026-111497 - Node.js Brotli decoder out-of-bounds write permits remote code execution (26.x, 24.x, 22.x; reported by mcollina, fixed by aduh95). (2) CVE-2026-105483 - TLS certificate hostname bypass when the IP is written with fullwidth digits (26.x, 24.x; reported by hasanfleyah, fixed by jasnell). (3) CVE-2026-106069 - TLS certificate hostname bypass when the host loosely resolves to an IP address (26.x, 24.x, 22.x; reported by anagnorisis2peripeteia, fixed by mcollina). (4) CVE-2026-105482 - dns.resolve truncates names containing a NUL character (26.x, 24.x, 22.x; reported by hasanfleyah, fixed by jasnell).
Medium severity: CVE-2026-105481 - a keep-alive socket processes a response that was written before the request was sent (HTTP request/response ordering); CVE-2026-106072 - improper certificate validation for non-canonical IPv4 hostnames lets DNS SANs authenticate IP endpoints; CVE-2026-106074 - crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and Single Executable Applications (SEAs), so every process repeats the same values. All three affect 26.x, 24.x and 22.x.
Low severity: CVE-2026-106070 - ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation (26.x only); CVE-2026-106071 - Permission Model filesystem over-grant via wildcard radix lookup (26.x only); CVE-2026-106073 - Permission Model bypass with fs.realpathSync (26.x, 24.x, 22.x).
Defensive relevance: the TLS hostname-verification flaws weaken endpoint authentication for Node.js clients that connect to IP-literal or IP-like hostnames, which could enable adversary-in-the-middle impersonation if the attacker holds a certificate with a matching DNS SAN. The Brotli decoder flaw is a memory-safety issue reachable when processing attacker-supplied Brotli-compressed data. The primary advisory does not list CWE identifiers, CVSS scores, attack vectors or exploitation status; no confirmed exploitation, public PoC, indicators of compromise or threat-actor attribution were found in the sources reviewed. NVD returned no record for CVE-2026-111497 at the time of research. Priority is patching affected Node.js runtimes. Per-CVE technical root cause beyond the advisory titles was not independently verified.
MITRE ATT&CK techniques used in TL-2026-4075
Initial Access
T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution
Credential Access
Collection
Affected products and versions in Node.js October 2026 Security Releases Fix 10
- OpenJS Foundation — Node.js
Vulnerable versions: 26.x (prior to 26.12.1); 24.x (prior to 24.22.1); 22.x (prior to 22.23.4)
Fixed in: 26.12.1; 24.22.1; 22.23.4
Remediation for Node.js October 2026 Security Releases Fix 10
Patches
- Node.js v26.12.1 (Current)
- Node.js v24.22.1 (LTS)
- Node.js v22.23.4 (LTS)
Immediate actions
- Inventory all Node.js runtimes (servers, containers, CI images, Electron/SEA builds) on the 26.x, 24.x and 22.x lines
- Upgrade to Node.js 26.12.1, 24.22.1 or 22.23.4 as appropriate
- Prioritize internet-facing services that decompress untrusted Brotli content or perform outbound TLS to IP-literal hosts
Workarounds
- No workarounds documented in the sources reviewed; Node.js versions must be upgraded
- Regenerate any startup snapshots and SEAs built with vulnerable versions that cache crypto.randomUUID()/randomInt() entropy
Longer-term hardening
- Subscribe to the nodejs-sec announcement channel and track Node.js security release blog posts
- Rebuild and redeploy container images and single executable applications so they embed the patched runtime
- Avoid TLS connections to IP-literal or non-canonical IP hostnames; use DNS names with proper certificate validation
CVEs associated with Node.js October 2026 Security Releases Fix 10
CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-105482, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073
Weaknesses (CWE) in Node.js October 2026 Security Releases Fix 10
Timeline of Node.js October 2026 Security Releases Fix 10
- Node.js published its June 2026 security releases for the 26.x, 24.x and 22.x lines (updating llhttp, nghttp2 and openssl), the previous coordinated security release before this one.
- Node.js 24.22.0 (LTS) and 26.12.0 (Current) were released; these and earlier versions on the affected lines are within the vulnerable range of the October fixes.
- Cyber Security News reported the release of the Node.js security updates fixing high-severity TLS, DNS and Brotli vulnerabilities.
- Advisory credited reporters hasanfleyah (CVE-2026-105481/105482/105483), mcollina (CVE-2026-111497), anagnorisis2peripeteia (CVE-2026-106069), br41ny (CVE-2026-106072), gesposito (CVE-2026-106074), startimeash (CVE-2026-106070), malikhamzaiqbal (CVE-2026-106071) and 0xoroot (CVE-2026-106073); fixes authored by jasnell, mcollina, aduh95, panva and RafaelGS.
- The advisory also lists bundled dependency updates: c-ares and Undici (26.x, 24.x, 22.x), a ca-cert update for the eMudhra Intermediate CA compromise (26.x, 24.x, 22.x), OpenSSL (24.x, 22.x) and SQLite (22.x).
- Patched versions Node.js 26.12.1, 24.22.1 and 22.23.4 were released by Antoine du Hamel.
- Node.js project published the October 21, 2026 Security Releases advisory disclosing 10 CVEs (4 High, 3 Medium, 3 Low).
Sources cited for Node.js October 2026 Security Releases Fix 10
- Node.js - Wednesday, October 21, 2026 Security Releases
- Node.js Releases Security Updates to Fix High-Severity TLS, DNS and Brotli Vulnerabilities (Cyber Security News)
- Node.js 26.12.1 (Current) release notes
- Node.js 24.22.1 (LTS) release notes
- Node.js 22.23.4 (LTS) release notes
- Node.js blog - year 2026 index
- Node.js - June 2026 Security Releases (prior security release)
Detection coverage for TL-2026-4075
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4075 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.