The Node.js project said in an advance notice dated 14 October 2026 that it will ship new versions of the 26.x, 24.x and 22.x release lines on or shortly after Wednesday 21 October 2026 to fix security vulnerabilities. The highest severity issue in each of the three lines is rated High.

Node.js has not yet published the CVE numbers, affected components or fixed version numbers; those come with the release. The project reminds users that end-of-life versions are always affected when a security release happens, which includes Node.js 20 (last release 20.20.2 in March 2026) and older lines that will get no fix.

Latest releases before the security update were 26.12.0 and 24.22.0 (both 14 October) and 22.23.3 (23 September). Node.js runs a large share of web back ends, build pipelines, serverless functions and developer tooling, including in Australian organisations. Separately, a trust-store change for the compromised eMudhra intermediate certificates was still listed as pending for Node.js on 21 October (see this desk's eMudhra card); the advance notice does not say whether this release includes it.

Primary: Node.js security release notice (14 Oct).

UPDATE (21 Oct): Node.js published the security releases: 26.12.1, 24.22.1 and 22.23.4. They fix ten vulnerabilities. High: CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js says permits remote code execution (26.x, 24.x, 22.x); CVE-2026-105482, dns.resolve truncating names that contain a NUL character (all three lines); CVE-2026-105483, a TLS certificate hostname check bypass when an IP address is written in fullwidth digits (26.x, 24.x); and CVE-2026-106069, a TLS hostname check bypass when the host loosely resolves to an IP address (all three).

Medium: CVE-2026-105481 (a keep-alive socket can process a response written before the request was sent), CVE-2026-106072 (DNS SANs can authenticate non-canonical IPv4 endpoints) and CVE-2026-106074 (crypto.randomUUID() and randomInt() entropy caches saved into startup snapshots and single executable applications, so every process repeats the same values). Low: CVE-2026-106070 (ZipFile returns attacker-controlled prefix bytes, 26.x), CVE-2026-106071 (Permission Model wildcard over-grant, 26.x) and CVE-2026-106073 (Permission Model bypass with fs.realpathSync).

The releases also update c-ares and Undici on all three lines, OpenSSL on 24.x and 22.x and SQLite on 22.x, and update Node's bundled CA certificates for the eMudhra intermediate CA compromise on all three lines. Node.js publishes severity ratings, not CVSS scores.

Primary: Node.js security release post (updated 21 Oct).

UPDATE (23 Oct 2026): Imperva's red team said on 22 October that its 'Node2Shell' proof of concept ran code carried in Brotli data inside applications on the official Node.js 24.22.0 Linux arm64 image, through both a response read with the built-in fetch() and request bodies decoded by Express 5 and body-parser 2 parsers; it says execution took multiple attempts, it did not test every Node.js build or application, and 24.22.1 rejected the same inputs.

Imperva says a bare Node.js HTTP server does not decode incoming Brotli bodies just by receiving them. Vercel said it deployed WAF rules on 21 October that block the inbound attack for projects on Vercel, but they do not cover responses an application fetches from other servers and do not replace patching. (source: Imperva; Vercel)

UPDATE (24 Oct 2026): The Brotli flaw CVE-2026-111497 is in Google's Brotli C decoder, so other software that ships its own copy of that decoder needs its own fix.

Google published fixed Brotli releases v1.2.1, v1.1.1 and v1.0.10 on 21 October, each listing 'CVE-2026-111497: out-of-bounds write permits remote code execution'.

Envoy's advisory GHSA-3wvj-j6qm-62mr (23 Oct, rated Critical, CVSS 4.0 9.2) says Envoy v1.39.2, v1.38.5, v1.37.7 and v1.36.11 are vulnerable in deployments that have the Brotli decompressor configured, and that the flaw was addressed in v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12.

Istio's bulletin ISTIO-SECURITY-2026-007 says users who enable Brotli decompression, for example with an EnvoyFilter, should upgrade, to 1.31.2, 1.30.6 or 1.29.9 (the final 1.29 release).

The Python Packaging Advisory Database (PYSEC-2026-4322 and PYSEC-2026-4323, 23 Oct) says the PyPI Brotli package up to and including 1.2.0 and brotlicffi releases before 1.2.1.0 carry the vulnerable decoder, fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0, and that with Brotli installed, common HTTP clients (urllib3/requests, httpx with the brotli extra, aiohttp) decode Brotli responses automatically.

Red Hat rates the flaw Important (CVSS 3.1 8.1) and says there is no public, reliable remote code execution proof of concept.

According to The Hacker News, Bun is also affected and no real-world attacks have been reported. (source: Google Brotli on GitHub; Envoy; Istio; PyPA advisory database; Red Hat; The Hacker News)

UPDATE (25 Oct 2026): According to iTnews, Australian researcher Paul McCarty, co-founder and chief technology officer of OpenSourceMalware, found potentially vulnerable software that uses Google's Brotli decoder across several open source ecosystems, including Python, Go, .NET and Perl. iTnews reports McCarty as saying that Chrome and Firefox have picked up the fix in their bundled copies of Brotli; that Electron desktop apps such as Signal, Slack, Discord and Visual Studio Code each carry their own copy of the browser engine and rely on their own update mechanisms; and that Microsoft's .NET runtime, the DuckDB database and the Pillow and pyarrow Python libraries carry their own copies of the decoder. iTnews also reports that a Google engineer added the fix to Brotli in February, described only as a change to detect and report invalid streams earlier, and that it was not in an official Brotli release until October. (source: iTnews)