The Node.js project has released security updates for its supported 26.x, 24.x and 22.x branches, addressing ten vulnerabilities across compression, TLS verification, DNS handling, HTTP connections, cryptographic randomness and filesystem permissions. Four issues are rated high severity, with a Brotli decoder memory corruption bug carrying the most serious potential outcome: remote code execution.

The patched releases are Node.js 26.12.1, 24.22.1 and 22.23.4. Operators should install the appropriate version for their branch, rebuild containers and serverless bundles that embed the runtime, and restart long-running services. Merely updating a development workstation will not replace Node.js copies already shipped in production images.

Brotli decoder bug can cross a trust boundary

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder affecting all three supported release lines. Writing beyond an allocated memory region can crash a process and, under suitable conditions, enable attacker-controlled code execution. Applications that automatically decompress untrusted Brotli content should be prioritized because remote input may reach the affected component.

The available advisory information does not fully describe the exploitation requirements. That uncertainty should not be interpreted as evidence of low risk. Internet-facing gateways, content-processing services and applications that accept compressed uploads have a clearer exposure path than systems that never handle attacker-controlled compressed data.

TLS and DNS inconsistencies weaken destination checks

Two high-severity vulnerabilities affect certificate hostname verification. CVE-2026-105483 concerns IP addresses written with full-width digits and affects the 26.x and 24.x branches. CVE-2026-106069 applies when a hostname loosely resolves to an IP address and affects 26.x, 24.x and 22.x. Both can cause an application to accept a certificate that should not match the intended endpoint.

These flaws are especially relevant to services that make outbound HTTPS requests based on user-controlled or tenant-provided destinations. Certificate validation is a core boundary against interception and redirection; unusual hostname representations should not produce a different security decision from their conventional form.

The fourth high-severity issue, CVE-2026-105482, causes dns.resolve to truncate names containing a NUL character. Security checks that inspect one string while the resolver uses a shortened version can create validation gaps. The bug affects all three supported branches.

Other fixes cover HTTP, randomness and permissions

CVE-2026-105481 addresses a keep-alive connection that can process a response written before its corresponding request was sent. CVE-2026-106072 corrects certificate validation for nonstandard IPv4 hostnames. Both are rated medium and apply to the supported branches.

Another medium-severity issue, CVE-2026-106074, can cause processes created from startup snapshots or single executable applications to repeat values returned by crypto.randomUUID() and crypto.randomInt(). Applications must not assume identifiers are unpredictable when runtime state has been cloned incorrectly.

Low-severity fixes address untrusted bytes exposed after failed ZIP header validation, wildcard behavior that grants excess filesystem access, and a Permission Model bypass through fs.realpathSync. The release also refreshes bundled components such as c-ares, CA certificates, Undici, OpenSSL and SQLite, depending on the branch.

What engineering teams should do now

• Inventory the exact Node.js runtime in hosts, containers, build images and serverless packages.
• Upgrade to 26.12.1, 24.22.1 or 22.23.4 and replace immutable artifacts.
• Test outbound HTTPS, DNS resolution and Brotli content handling after the update.
• Review applications that use startup snapshots or single executables for security-sensitive random values.
• Migrate any end-of-life Node.js branch to a supported release line.

Teams should also verify the runtime from inside the deployed artifact rather than trusting a manifest or base-image tag. Moving tags can leave cached layers in place, and package-lock updates do not necessarily upgrade the Node.js executable.

The breadth of this release makes it relevant even to applications that do not use Brotli directly. TLS and DNS behavior sits underneath common HTTP libraries, while embedded runtime copies can be easy to miss. A complete response combines patching with an inventory of where Node.js actually executes across the delivery pipeline.