If your website, API or web app runs on Node.js, you have an update to schedule this week. On 21 October 2026 the Node.js project published a security release that fixes 10 vulnerabilities across all three supported release lines. Four are rated high. The one getting the most attention is a flaw in the Brotli decompression code that Node.js bundles, tracked as CVE-2026-111497.
This guide is written for business owners and the people who look after their software. It explains what changed, who should act, and what to do in what order. It does not include exploit details.
What to update to
Each supported line has one fixed version:
| Release line | Fixed version |
|---|---|
| Node.js 22.x | 22.23.4 |
| Node.js 24.x | 24.22.1 |
| Node.js 26.x | 26.12.1 |
Node.js 20 and earlier are end of life and receive no fix, so any app still on them needs a move to a supported line. The Node.js project also notes that end-of-life versions are always affected when a security release is published.
The Brotli flaw in plain language
Brotli is a compression format. Node.js includes its own copy of the Brotli decoder and runs it whenever it decompresses Brotli data, either through the node:zlib module or automatically when code calls fetch() on a response sent with Brotli compression.
CVE-2026-111497 is an out-of-bounds write in that decoder. The Node.js project says it permits remote code execution and rates it high. According to The Hacker News, an app is exposed where it decompresses Brotli data that an attacker controls, such as a request body or a response fetched from another server.
What is known about real-world risk, as reported on 22 October 2026:
- No exploitation in the wild had been reported.
- A public proof of concept reached code execution only against a deliberately weakened test build. On a standard build its author reported a crash and a limited memory read.
- The same upstream fix was released in Brotli 1.2.1, 1.1.1 and 1.0.10, so other software that bundles Brotli may also need an update.
That is reassuring, but it is no reason to wait. Proofs of concept improve quickly after publication.
The other high-severity fixes
Three more high-rated issues were fixed in the same release:
- CVE-2026-106069 and CVE-2026-105483: TLS hostname checks could be bypassed when a server's IP address is written in an unusual form. The second affects 24.x and 26.x only. This matters for apps that connect to other services by IP address.
- CVE-2026-105482:
dns.resolvecut hostnames short at an embedded null character.
Among the medium-rated fixes, CVE-2026-106074 can make crypto.randomUUID() and crypto.randomInt() return the same values in every process when an app is built as a startup snapshot or single-executable application. If you rely on those values being unpredictable, this one matters.
What to do this week
- List every place Node.js runs. Servers, containers, build pipelines, serverless functions, internal tools and any app built by a past vendor.
- Check the version with
node -von each, and note which release line it is on. - Update to 22.23.4, 24.22.1 or 26.12.1. Rebuild container images from a fresh base image rather than patching in place.
- Restart every process so it runs on the new version.
- Move off Node.js 20 and older. Treat them as unpatched.
- Ask your hosting provider whether managed runtimes (for example serverless or platform-as-a-service) have been updated, and when.
- Update software that bundles its own Brotli once its vendor publishes a fix.
- Put this in a routine. A monthly review of runtime versions is part of good website maintenance.
How this connects to this week's PHP news
Runtime-level bugs like this one live below your own code, so reviewing your application will not find them. Only updating the runtime does. The same lesson applied to the PHP flaws patched a day earlier, which we cover in our PHP2Shell patch guide. If you are choosing a stack for a new product, our notes on a tech stack for startups cover how to plan for updates from the start.
Need a hand finding and updating the runtimes behind your site or app? Talk to Susraj Tech.
Frequently asked questions
Which Node.js versions fix the October 2026 vulnerabilities?
Node.js 22.23.4, 24.22.1 and 26.12.1.
Is the Brotli flaw being exploited?
None had been reported as of 22 October 2026, per The Hacker News. Check the sources below for updates.
Do I need to restart after updating?
Yes. Running processes keep the old runtime until they are restarted or replaced.
Sources
- Node.js: Wednesday, October 21, 2026 Security Releases
- The Hacker News: Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Last reviewed 22 October 2026. This article is general security information, not a guarantee of protection. Details may change as the Node.js project and vendors publish more information.
