Node.js Fixes 10 Vulnerabilities, Including Actively Exploited Node2Shell

Summary

Node.js October 2026 updates fix 10 flaws across 22.x, 24.x and 26.x, including the actively exploited critical Node2Shell Brotli flaw and DNS/TLS validation bugs. The update also removes trust in eight compromised eMudhra intermediate CA certificates.

Key points

The October 2026 updates address 10 vulnerabilities across Node.js 22.x, 24.x and 26.x: one Critical, three High, three Medium and three Low.
Critical CVE-2026-111497, known as Node2Shell, is an out-of-bounds write in the bundled Brotli decoder that may expose memory, cause denial of service or potentially enable remote code execution.
The article says Node2Shell was added to CISA’s Known Exploited Vulnerabilities catalog and that public proof-of-concept exploits have been reported.
CVE-2026-105482 can cause NUL-byte hostname truncation in Node.js DNS functions, potentially bypassing domain allowlist checks.
CVE-2026-105483 and CVE-2026-106069 involve TLS hostname verification issues with non-ASCII or non-canonical IPv4 representations; the article says it could not verify in-the-wild exploitation of these three flaws.
Fixed releases are 26.12.1, 24.22.1 and 22.23.4. Recommendations include upgrading, preserving certificate validation and reviewing custom TLS callbacks.
Separately, Node.js removed trust in eight compromised intermediate eMudhra CA certificates.

Article Details

Vulnerability Types: Out-of-bounds write in the Brotli decoder
NUL-byte truncation causing hostname validation bypass in DNS resolution
TLS certificate hostname verification bypass
Severity: Critical (CVSS v4.0 9.2 for CVE-2026-111497)
Affected Versions: Node.js 22.x
Node.js 24.x
Node.js 26.x
Exploitation Status: active
Exploit Availability: public_poc
Patch Status: available
Workarounds: Use canonical dotted-decimal IPv4 addresses and reject non-canonical or non-ASCII representations.
Use an IP-address SAN for IP-address connections.
Do not disable certificate validation or set rejectUnauthorized: false.
Audit custom checkServerIdentity() callbacks and code that overrides or bypasses default certificate verification.
Validate user-supplied outbound URLs and destination addresses against security policies.