cyber.hendryadrian.com
Vulnerability & Exploit · blog.qualys.com

Node.js Fixes 10 Vulnerabilities, Including Brotli Remote Code Execution Flaw

· Original article ↗

Summary

Node.js fixed 10 flaws across supported 22.x, 24.x and 26.x lines, including a Brotli decoder out-of-bounds write that may enable remote code execution. Qualys says most observed installations remain unpatched or unsupported and recommends upgrading runtimes.

Key points

  • The October 21, 2026, release fixes 10 vulnerabilities, including four rated High, in Node.js 22.x, 24.x and 26.x.
  • CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that Node.js says can permit remote code execution when processing crafted compressed data.
  • DNS and TLS flaws can truncate queried names at embedded NUL characters or weaken hostname and certificate validation for non-canonical IP addresses.
  • Fixed releases are Node.js 22.23.4, 24.22.1 and 26.12.1. Unsupported lines, including 25.x and 20.x or earlier, have no fixes and should be upgraded to a supported line.
  • Qualys says its analysis of 3.3 million Node.js installations found 15% on internet-facing assets and only 42,000 installations patched at the time of analysis.
  • Application dependency updates alone do not fix vulnerable runtime copies embedded in containers, single-executable applications or other nonstandard locations.
  • Node.js published no official workarounds; Qualys advises limiting exposure while upgrading and warns that its QID 533085 application check may crash vulnerable applications.

Article Details

Vulnerability Types
  • Out-of-bounds write in the Brotli decoder
  • DNS resolution truncation caused by embedded NUL characters
  • TLS hostname validation bypass using non-canonical IP addresses
  • TLS hostname validation bypass using Unicode fullwidth digits
  • HTTP keep-alive response handling issue
  • Improper certificate validation for unusual IPv4 representations
  • Repeated random values across startup snapshots
  • ZIP validation issue that can return bytes from the wrong file position
  • Permission Model filesystem over-grant
  • Permission Model bypass through fs.realpathSync
Severity
Four vulnerabilities are rated High by Node.js; CVE-2026-111497 has a CVSS 4.0 score of 9.2 (Critical).
Affected Versions
  • Node.js 22.0.0–22.23.3
  • Node.js 23.0.0–23.11.1
  • Node.js 24.0.0–24.22.0
  • Node.js 25.0.0–25.9.0
  • Node.js 26.0.0–26.12.0
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Where possible, avoid decompressing untrusted Brotli input; limit compressed payload size and decompression ratio at the reverse proxy or WAF.
  • Use dns.lookup instead of dns.resolve* for user-supplied names and reject hostnames containing NUL characters.
  • Canonicalize IP addresses before TLS connections and reject fullwidth or other non-canonical forms.
  • Disable keepAlive on http.Agent for connections to untrusted servers.
  • Do not rely on the Permission Model as a security boundary on affected versions.

CVE

CVE-2026-105481CVE-2026-105481 Medium HTTP HTTP keep-alive response handling issue 22.x, 24.x, 26.xCVE-2026-105482Hostname and certificate checks (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069): These flaws weaken Node.js’s ability to verify hostnames and certificates.CVE-2026-105483Hostname and certificate checks (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069): These flaws weaken Node.js’s ability to verify hostnames and certificates.CVE-2026-106069Hostname and certificate checks (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069): These flaws weaken Node.js’s ability to verify hostnames and certificates.CVE-2026-106070CVE-2026-106070 Low zlib (ZipFile) ZIP validation exposes attacker-controlled bytes 26.xCVE-2026-106071CVE-2026-106071 Low Permission Model Permission Model filesystem over-grant 26.xCVE-2026-106072CVE-2026-106072 Medium TLS Improper certificate validation for unusual IPv4 representations 22.x, 24.x, 26.xCVE-2026-106073CVE-2026-106073 Low fs / Permission Model Permission Model bypass using fs.realpathSync 22.x, 24.x, 26.xCVE-2026-106074CVE-2026-106074 Medium crypto Repeated random values across startup snapshots 22.x, 24.x, 26.xCVE-2026-111497The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution.

Vendors

QualysWhat Qualys Customers Can Do

Products

Container SecurityCover cloud, containers, and serverless with TotalCloud and Container Security.Node.jsNode.js by the Numbers: Nine in 10 Installations Are Unpatched or UnsupportedQualys InstaScanQualys customers can detect exposure with InstaScan as soon as the advisory is published and find affected runtimes across hosts, containers, and cloud workloads, including copies outside standard install paths.TotalAppSecExtend Node.js Remediation Verification to Web Applications and APIs with TotalAppSecTotalCloudFor comprehensive remediation verification, use Qualys VMDR or TotalCloud to check the installed Node.js runtime versions and patch status in conjunction with TotalAppSec’s application-level assessment.TruRisk EliminateThey can then prioritize those exposed to the internet, patch with TruRisk Eliminate, and confirm each fix.VMDRFor comprehensive remediation verification, use Qualys VMDR or TotalCloud to check the installed Node.js runtime versions and patch status in conjunction with TotalAppSec’s application-level assessment.

Related Articles