# Node.js October 2026 Security Releases Fix 10 Vulnerabilities Including Brotli Decoder RCE and TLS Hostname Verification Bypasses (CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-105482)

> On 2026-10-21 the Node.js project shipped coordinated security releases 26.12.1, 24.22.1 and 22.23.4 fixing 10 vulnerabilities (4 High, 3 Medium, 3 Low). The High-severity set covers a Brotli decoder out-of-bounds write that permits remote code execution, two TLS certificate hostname verification bypasses and a dns.resolve NUL-truncation flaw. No exploitation in the wild, public PoC or attribution is reported.

- **Published:** 2026-10-21T23:35:21Z
- **Last reviewed:** 2026-10-21T23:35:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4075
- **ID:** TL-2026-4075
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-105482, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073

## Description

The Node.js project published its "Wednesday, October 21, 2026 Security Releases" advisory alongside new releases v26.12.1 (Current), v24.22.1 (LTS) and v22.23.4 (LTS). Ten CVEs are fixed: four rated High, three Medium and three Low. Affected lines are 26.x, 24.x and 22.x, although individual CVEs only affect a subset of lines.

High severity: (1) CVE-2026-111497 - Node.js Brotli decoder out-of-bounds write permits remote code execution (26.x, 24.x, 22.x; reported by mcollina, fixed by aduh95). (2) CVE-2026-105483 - TLS certificate hostname bypass when the IP is written with fullwidth digits (26.x, 24.x; reported by hasanfleyah, fixed by jasnell). (3) CVE-2026-106069 - TLS certificate hostname bypass when the host loosely resolves to an IP address (26.x, 24.x, 22.x; reported by anagnorisis2peripeteia, fixed by mcollina). (4) CVE-2026-105482 - dns.resolve truncates names containing a NUL character (26.x, 24.x, 22.x; reported by hasanfleyah, fixed by jasnell).

Medium severity: CVE-2026-105481 - a keep-alive socket processes a response that was written before the request was sent (HTTP request/response ordering); CVE-2026-106072 - improper certificate validation for non-canonical IPv4 hostnames lets DNS SANs authenticate IP endpoints; CVE-2026-106074 - crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and Single Executable Applications (SEAs), so every process repeats the same values. All three affect 26.x, 24.x and 22.x.

Low severity: CVE-2026-106070 - ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation (26.x only); CVE-2026-106071 - Permission Model filesystem over-grant via wildcard radix lookup (26.x only); CVE-2026-106073 - Permission Model bypass with fs.realpathSync (26.x, 24.x, 22.x).

Defensive relevance: the TLS hostname-verification flaws weaken endpoint authentication for Node.js clients that connect to IP-literal or IP-like hostnames, which could enable adversary-in-the-middle impersonation if the attacker holds a certificate with a matching DNS SAN. The Brotli decoder flaw is a memory-safety issue reachable when processing attacker-supplied Brotli-compressed data. The primary advisory does not list CWE identifiers, CVSS scores, attack vectors or exploitation status; no confirmed exploitation, public PoC, indicators of compromise or threat-actor attribution were found in the sources reviewed. NVD returned no record for CVE-2026-111497 at the time of research. Priority is patching affected Node.js runtimes. Per-CVE technical root cause beyond the advisory titles was not independently verified.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1557 Adversary-in-the-Middle
- T1557 Adversary-in-the-Middle

## Sources

- [Node.js - Wednesday, October 21, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
- [Node.js Releases Security Updates to Fix High-Severity TLS, DNS and Brotli Vulnerabilities (Cyber Security News)](https://cybersecuritynews.com/node-js-releases-security-updates/)
- [Node.js 26.12.1 (Current) release notes](https://nodejs.org/en/blog/release/v26.12.1)
- [Node.js 24.22.1 (LTS) release notes](https://nodejs.org/en/blog/release/v24.22.1)
- [Node.js 22.23.4 (LTS) release notes](https://nodejs.org/en/blog/release/v22.23.4)
- [Node.js blog - year 2026 index](https://nodejs.org/en/blog/year-2026)
- [Node.js - June 2026 Security Releases (prior security release)](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4075