Qualys Details Interim Mitigations for Node.js Flaws While Upgrades Roll Out
Summary
Qualys outlines interim mitigations for Node.js flaws, including CVE-2026-111497, and recommends prioritizing exposed runtimes, adding WAF/IPS/EDR controls, then upgrading and verifying. Its telemetry found 42,000 of 3.3 million installations patched.
Key points
- Node.js’s October 21 security release fixes 10 vulnerabilities, including CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution.
- Fixed releases are 22.23.4, 24.22.1, and 26.12.1; end-of-life lines such as 25.x, 23.x, 21.x, and 20.x must move to a supported line to receive fixes.
- Qualys telemetry reported that 42,000 of 3.3 million installations were patched and 1.7 million ran end-of-life versions.
- Prioritize internet-facing services that decompress untrusted Brotli data, followed by services connecting to user-supplied TLS hosts.
- Qualys Threat Research Unit interim steps include limiting untrusted Brotli decompression, using dns.lookup for user-supplied names, canonicalizing IP addresses, disabling keep-alive for untrusted servers, and not relying on the affected Permission Model as a security boundary.
- The article says WAF and IPS protections can block exploit requests and EDR policies can help stop post-exploitation behavior; these controls reduce risk but do not replace upgrading.
- After upgrading, rebuild and redeploy embedded runtimes, restart Node.js services, and rescan to verify remediation; test applications after applying interim changes.
Article Details
- Defense Focus
- Reduce exposure to vulnerable Node.js runtimes while upgrades are pending, then patch, restart, and verify every affected runtime.
- Detection Methods
- Search asset inventories for the cited Node.js CVEs across hosts, containers, and cloud workloads, including bundled runtimes and copies outside standard installation paths.
- Prioritize internet-facing services that decompress untrusted Brotli data, followed by services connecting to user-supplied TLS hosts.
- Use WAF and IPS protections to block exploit requests before they reach the Node.js decoder.
- Use EDR behavioral and exploit-prevention policies to monitor Node.js process behavior, including shell spawning, binary downloads, and memory exploitation.
- Rescan after remediation and confirm that the relevant detection QIDs are closed.
- Data Sources
- Qualys asset and vulnerability findings for Node.js runtimes
- Cloud Agent and Container Security scan results
- EDR process-behavior and memory-exploitation telemetry
- WAF rules and IPS signatures
- Rule Types
- WAF rules identifying the Brotli flaw
- IPS signatures identifying the Brotli flaw
- EDR behavioral and exploit-prevention policies
- Qualys vulnerability detection QIDs
- Platforms
- Web application firewalls (WAF)
- Intrusion prevention systems (IPS)
- Endpoint detection and response (EDR)
- Host, container, and cloud workload environments
- Defensive Actions
- Avoid decompressing untrusted Brotli data where possible; cap payload size and decompression ratio at the reverse proxy or WAF.
- For user-supplied names, use dns.lookup instead of dns.resolve* and reject hostnames containing NUL characters.
- Canonicalize IP addresses before TLS connections and reject fullwidth or other non-canonical forms.
- Disable keepAlive on http.Agent for connections to servers you do not control.
- Do not rely on the Permission Model as a security boundary on affected versions.
- Test affected applications after each interim change because mitigations may affect application behavior and do not eliminate all exploitation paths.
- Keep applicable WAF, IPS, and EDR protections enabled and current; set the Cloudflare rule to Block.
- Upgrade to a fixed Node.js release, move end-of-life lines to a supported release, rebuild and redeploy embedded runtimes, restart Node.js services, and rescan.
MITRE ATT&CK
CVE
CVE-2026-105481Turn off keep-alive for untrusted servers (CVE-2026-105481).CVE-2026-105482Use the safer DNS call (CVE-2026-105482).CVE-2026-105483Services that open TLS connections to user-supplied hosts (CVE-2026-106069, CVE-2026-105483) come next.CVE-2026-106069Services that open TLS connections to user-supplied hosts (CVE-2026-106069, CVE-2026-105483) come next.CVE-2026-106071(CVE-2026-106071, CVE-2026-106073) Do not rely on it as a security boundary on affected versions.CVE-2026-106072Canonicalize IP addresses (CVE-2026-106069, CVE-2026-105483, CVE-2026-106072).CVE-2026-106073(CVE-2026-106071, CVE-2026-106073) Do not rely on it as a security boundary on affected versions.CVE-2026-111497Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow.
Vendors
Check PointWAF and IPS vendors such as Cloudflare, Fortinet, and Check Point have released protections that name the Brotli flaw.CloudflareWAF and IPS vendors such as Cloudflare, Fortinet, and Check Point have released protections that name the Brotli flaw.CrowdStrikeBehavioral and exploit-prevention policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense.FortinetWAF and IPS vendors such as Cloudflare, Fortinet, and Check Point have released protections that name the Brotli flaw.MicrosoftBehavioral and exploit-prevention policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense.QualysComing Next: Give Your Controls Credit in Qualys ETM
Products
Cloud AgentRescan with Cloud Agent or Container Security and confirm the detection QIDs are closed.Container SecurityRescan with Cloud Agent or Container Security and confirm the detection QIDs are closed.Cortex XDRBehavioral and exploit-prevention policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense.CrowdStrike FalconBehavioral and exploit-prevention policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense.Microsoft Defender for EndpointBehavioral and exploit-prevention policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense.Node.jsStep 1: Find and Prioritize Exposed Node.jsQualys ETMComing Next: Give Your Controls Credit in Qualys ETMTruRisk EliminateCustomers can deploy supported vendor patches through TruRisk Eliminate, so check the patch catalog for their line.