Node.js security update: 10 CVEs, Brotli RCE, fixed versions

Node.js shipped security releases on 21 October 2026 that fix 10 CVEs, including a Brotli decoder bug that allows remote code execution (CVE-2026-111497). The fixed versions are 22.23.4, 24.22.1 and 26.12.1. Upgrade the Node.js runtime itself, rebuild any image that bundles it, and redeploy. The Node.js notice does not call for credential rotation.

Which Node.js versions are affected?

Every supported line is. The Brotli bug affects 22.x, 24.x and 26.x. The notice does not publish an exact first-affected patch number, so the rule is simple: if your node --version is below the fixed version for your line, you are in scope.

The release schedule at our check on 24 October 2026 showed v22 and v24 as LTS and v26 as Current. It listed v18, v20 and v25 as end of life. For those lines the Node.js project says end-of-life versions are always affected and publishes no fix, so the only route is a supported line.

Only sites and services that run a Node process are in scope: a Next.js or Express server, an API, a worker, a managed Node runtime. A PHP site or a static site can still have a Node API or worker behind it, so check what else runs for the same domain. A PHP runtime has a different bug to deal with, covered in our write-up of the PHP runtime flaw. Build tools and CI runners use Node too, so check them separately. If the Node process is a Next.js app, the Next.js remote-code-execution fixes and the Server Actions denial-of-service check are separate upgrades on top of this one.

What is in the other nine CVEs?

The Node.js project lists each one on its security notice. Titles below are the project's own.

So the release covers more than one RCE and one TLS bypass. Four issues are rated High, and three of them concern how hostnames and addresses are checked.

The same notice says the releases also update bundled dependencies: c-ares, ca-cert (listed as "eMudhra Intermediate CA Compromise"), OpenSSL, SQLite and Undici. The certificate part is explained in our eMudhra page. Another certificate change that can break server-to-server calls is the clientAuth removal that hits mTLS.

Why does updating npm packages not fix it?

The Brotli fix is a change to a library vendored inside the runtime. The 24.22.1 release notes list it as "deps: brotli", next to the CVE id. Running npm update changes your application's packages and leaves the runtime as it was. Whether a poisoned package ever ran on your build machine is a different question, covered in build machines versus the live site for the npm worms.

Three places keep an old runtime alive after you think you upgraded:

1. Container images. A fixed base image does nothing until your application image is rebuilt from it and deployed.
2. Pinned runtimes. A version manager, a CI setup step, an .nvmrc or engines setting, or a platform setting can pin the old line.
3. The version string. A version read from outside, or on your laptop, says nothing about the runtime the service uses. Run node --version in the running context.

How do I fix it?

What do I do if a host or platform runs Node for me?

Send support this question and keep the reply:

For [your app or domain], which Node.js version does the running service use, and is it 22.23.4, 24.22.1, 26.12.1 or a build that names CVE-2026-111497? Please confirm the service was restarted or redeployed after the runtime changed, and tell me whether I must change a setting or redeploy myself.

• Find the runtime setting in your platform (often an engines field, a version dropdown or a build setting) and move it to a fixed version.
• Redeploy, because a changed setting does not restart a running service.
• Keep the written reply from support.

What do I do if I manage the server or pipeline myself?

• Run node --version in the real context: the running container, the CI job, the build step. Not only your laptop.
• Upgrade to the fixed version for your line, from the Node.js project or your distribution.
• Rebuild every image that bundles Node and redeploy it.
• Restart long-running processes, since an upgrade on disk does not change a process already running.
• Move anything on 18, 20 or 25 to a supported line and test it.
• Check embedded runtimes, such as Node bundled into a desktop app or a single executable.

Am I affected? A three-state self-test

Was this exploited?

The Node.js notice describes the conditions for each bug and reports no attacks. That is silence, and silence is not proof that nothing happened. Some entries carry conditions of their own. For CVE-2026-106072 the notice says exploitation needs a numeric DNS SAN in a certificate from a CA the client trusts, and a platform resolver that accepts the odd IPv4 spellings, such as glibc.

The notice does not call for credential rotation.

What is the Brotli bug, without the exploit?

According to the Node.js notice, an invalid block switch in the Brotli stream was reported as a temporary need for more input instead of a permanent format error. The streaming decoder then kept writing input bytes into an eight-byte internal buffer. The project lists the impact as a crash, disclosure of process memory, or remote code execution. The notice credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer as reporters, with fixes by the contributors mcollina and aduh95. We do not reproduce exploit material here, and you do not need it to upgrade.

At our check on 24 October 2026 the notice named the application pattern: an attacker who can supply Brotli data that an application decompresses with node:zlib. If your code does that, upgrade first. Treat any service on an affected line as in scope and upgrade.

More incident pages from October 2026 and the other incident write-ups are collected on one page.