Most teams need a version bump and a restart, but end-of-life runtimes and services that handle untrusted data face harder work.
Quick Read
- Fixed versions are 22.23.4, 24.22.1 and 26.12.1, and 26.x carries all 10 flaws while 24.x carries eight and 22.x seven.
- The Brotli decoder flaw, CVE-2026-111497, reaches remote code execution only where an application decompresses Brotli data an attacker controls.
- Three of the four high-rated flaws concern hostname handling in DNS lookups and TLS certificate checks, and two of those three follow earlier CVE fixes.
- Node.js 20 and other end-of-life versions get no fix, so teams on them face a migration.
- Services that fetch outside content or URLs for AI features meet the conditions two of these flaws describe.
The Node.js security update released on October 21 fixes 10 vulnerabilities, four rated high, in versions 22.23.4, 24.22.1 and 26.12.1. By the advisory’s listings, the 26.x line carries all 10 flaws, 24.x carries eight and 22.x carries seven.
The headline flaw is CVE-2026-111497, an out-of-bounds write in the Brotli decoder. The advisory credits OpenAI Codex Security, with researchers Khai Tran and Sylvie Mayer, for reporting it. For most teams the Node.js security update means a version bump and a restart. The harder cases are end-of-life runtimes and services that pass untrusted data into the affected functions.
What the Node.js Security Update Fixes
The 10 Node.js vulnerabilities split into four rated high, three medium and three low. The release also updates bundled dependencies, including c-ares, Undici and OpenSSL. Four of the 10 fixes follow earlier ones. Three are described as incomplete fixes of earlier CVEs and one as a regression introduced after an earlier fix. Two of those four are rated high.
Brotli Decoder Flaw Needs Attacker-Controlled Input
An invalid block switch was reported as a request for more input instead of a format error, so the decoder kept writing bytes into an eight-byte internal buffer. An attacker who can supply Brotli data that an application decompresses with the Node.js zlib module can corrupt process memory. The advisory lists a crash, disclosure of process memory or remote code execution as the outcomes.
The condition limits the risk. Vercel said in a security advisory that applications are affected when their own code, or a library they use, decompresses attacker-controlled Brotli data, including responses an application fetches. According to published reports, proof-of-concept code is public, and Imperva’s red team reported full remote code execution in applications running the official Node.js 24.22.0 image, a version that predates the fix. Those reports said no attacks had been seen in the wild.
DNS and TLS Hostname Checks
Hostname handling accounts for most of the high-rated flaws in the Node.js security update. In CVE-2026-105482, the dns.resolve functions cut a name off at a NUL byte, so an application that checks a hostname against a domain allowlist and then resolves it can act on records for a different name than the one it checked. CVE-2026-105483 and CVE-2026-106069 let a TLS certificate authenticate an IP address it was not issued for, through fullwidth digits in one case and a leading-zero address in the other. Node.js reads a leading zero as octal, while some operating systems, macOS among them, read it as decimal. The fullwidth-digit flaw does not affect 22.x.
AI Services and the Patch Queue
Philippine AI adoption is growing, but the size of it depends on the survey. A study commissioned by Amazon Web Services found 32% of Philippine companies using AI in 2026, up from 21% in 2025. A 2025 study by the Philippine Institute for Development Studies found 14.9% of firms using AI tools. In a survey commissioned by Alibaba Cloud and released in July, 51% of Philippine respondents named data privacy and security as their top local challenge.
Where a service built for an AI feature fetches outside content or URLs, two conditions in the Node.js security update apply. Compressed data from outside can reach the Brotli decoder, and a URL checked against an allowlist can resolve to a different name than the one checked.
End-of-Life Node.js Gets No Fix
The advisory says end-of-life versions are always affected by a security release and tells users to move to a supported version. According to published advisories, Node.js 20 reached end of life on April 30, 2026, so a team still on it has no patch to install. Published guidance for supported lines is to update to a fixed version, rebuild application images, restart services, and test TLS connections, DNS lookups, compressed data handling and file access restrictions.
For most teams, the Node.js security update is a version bump and a restart. For teams on Node.js 20, on images built before October 21, and on services that handle untrusted Brotli data or hostnames, it is a migration or an audit of what the service accepts from outside.
Monitor the systems, tools, and digital infrastructure decisions redefining competitive advantage in the Tech section of Hemos PH.
