VULNpocalypse
CriticalVulnerabilityPatch available

Node.js October 2026 security release: Brotli RCE now exploited, plus TLS hostname bypasses

Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including a Brotli decoder flaw now on CISA’s exploited list and three TLS certificate checks.

Published
Updated
Ecosystem
Node.js
Fixed in
Node.js 26.12.1, 24.22.1, 22.23.4
Exploitation
Brotli flaw CVE-2026-111497 in CISA KEV since 27 Oct 2026; attacked products not named

Live scores

CVE-2026-111497
EPSS
0.826
very likely to be attacked soon
VEDAS
0.977
strong exploit evidence
On CISA KEV
Yes, since 2026-10-27
Detection rule
None yet
EPSS (chance of attack)
100.1Added to CISA KEV 2026-10-27CVE-2026-111497 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9Added to CISA KEV 2026-10-27CVE-2026-111497 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

VEDAS flagged this bug about 3 days before CISA confirmed attacks.

Live scores

CVE-2026-105482
EPSS
0.005
low predicted chance of attack
VEDAS
0.500
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-105482 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-105482 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-105483
EPSS
0.003
low predicted chance of attack
VEDAS
0.829
some exploit evidence
On CISA KEV
Not listed
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-105483 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-105483 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-106069
EPSS
0.003
low predicted chance of attack
VEDAS
0.971
strong exploit evidence
On CISA KEV
Not listed
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-106069 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-106069 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-105481
EPSS
0.003
low predicted chance of attack
VEDAS
0.508
some exploit evidence
On CISA KEV
Not listed
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-105481 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-105481 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-106072
EPSS
0.006
low predicted chance of attack
VEDAS
0.973
strong exploit evidence
On CISA KEV
Not listed
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-106072 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-106072 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-106074
EPSS
0.003
low predicted chance of attack
VEDAS
0.050
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-106074 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-106074 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-106070
EPSS
0.004
low predicted chance of attack
VEDAS
0.055
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-106070 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-106070 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-106071
EPSS
0.002
low predicted chance of attack
VEDAS
0.511
some exploit evidence
On CISA KEV
Not listed
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-106071 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-106071 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-106073
EPSS
0.003
low predicted chance of attack
VEDAS
0.502
some exploit evidence
On CISA KEV
Not listed
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-106073 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-106073 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

What happened

Node.js shipped security releases for its three supported lines on 21 October 2026: 26.12.1, 24.22.1 and 22.23.4. They fix ten CVEs, four rated high, three medium and three low (Node.js).

The one that matters most is CVE-2026-111497. A malformed Brotli stream made the streaming decoder keep writing past an eight-byte internal buffer. Node.js says an attacker who can supply Brotli data that an app decompresses with node:zlib can cause “a crash, disclosure of process memory, or remote code execution”. It was reported by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer (Node.js).

The bug is in Google’s Brotli library itself, versions 1.0.3 to 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1. The CVE record scores it 9.2 (critical) under CVSS v4.0 (CVE-2026-111497). Node.js rates it high. CISA added it to the Known Exploited Vulnerabilities catalog on 27 October 2026, with a 10 November deadline for federal agencies (CISA KEV). CISA gave no detail on the attacks, and press reports call the flaw “Node2Shell” (BleepingComputer). Because the bug is in Brotli, it is not only a Node.js problem: Canada’s Cyber Centre lists .NET, PowerShell, Bun, Envoy, Istio and the Python Brotli and brotlicffi packages among affected technologies (Canadian Centre for Cyber Security).

The other nine (Node.js):

CVESeverityWhat it does
CVE-2026-105482Highdns.resolve*() and dns.reverse() cut hostnames at a NUL byte, so code can validate one name and resolve another. Incomplete fix of CVE-2026-48930.
CVE-2026-105483Hightls.checkServerIdentity() misses IP addresses written in fullwidth digits, so a certificate can be accepted for an IP it was not issued for. 26.x and 24.x only.
CVE-2026-106069HighLeading-zero IPv4 such as 0127.0.0.1 is read as octal in one place and decimal in another, so certificate checks can target a different IP from the one connected to.
CVE-2026-105481MediumData that arrives on an idle keep-alive socket can be read as the response to the next request. Incomplete fix of CVE-2026-48931.
CVE-2026-106072MediumNon-canonical IPv4 spellings such as 127.1 or 0x7f.0.0.1 can be authenticated by a DNS SAN of 127.0.0.1.
CVE-2026-106074Mediumcrypto.randomUUID(), randomUUIDv7() and randomInt() caches get saved into startup snapshots and single executable applications (SEAs), so every process repeats the same values.
CVE-2026-106070LowZipFile can return attacker-controlled prefix bytes after a failed header check. 26.x only.
CVE-2026-106071LowA wildcard grant in the Permission Model can also allow a shorter path. 26.x only.
CVE-2026-106073Lowfs.realpathSync() skips read-permission checks under --permission. Incomplete fix of CVE-2026-21715.

The releases also update c-ares, Undici, OpenSSL (24.x and 22.x) and SQLite (22.x). They update the bundled CA certificates for what Node.js calls the “eMudhra Intermediate CA Compromise” on all three lines. The release notes give no further detail on that compromise (Node.js).

Am I affected?

Every Node.js 22, 24 and 26 release before the versions above is affected by at least the Brotli bug. Node.js says end-of-life versions “are always affected” when a security release ships (Node.js), and Node.js 20 is end of life (Node.js releases).

You are most exposed if your app decompresses Brotli data it did not create, for example request bodies or responses from servers you do not control. The TLS bugs matter if you connect to hosts by IP address over TLS. CVE-2026-106074 matters if you build snapshots with --build-snapshot or ship an SEA built with useSnapshot.

bash
# The Node.js you run locally, and every copy on the PATH
node --version
which -a node

# The Node.js inside the image you actually deployed
docker run --rm --entrypoint node your-image:tag --version

# Distribution packages
dpkg -l | grep -E '^ii\s+nodejs'   # Debian, Ubuntu
rpm -q nodejs                      # RHEL, Fedora, Amazon Linux

# Version managers
nvm ls
volta list node

# Where your own code decompresses Brotli (dependencies may do it too)
grep -rnE "createBrotliDecompress|brotliDecompress" --include='*.js' --include='*.mjs' --include='*.cjs' --include='*.ts' .

What to do now

  1. Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4, or later, everywhere it runs: servers, laptops, CI runners and serverless runtimes (Node.js). On managed platforms, check that the provider has rolled the patched runtime out.
  2. Rebuild your container images from a patched base and redeploy. Pin by digest or exact version so you can tell what is running.
  3. Rebuild SEAs and snapshots. A single executable application carries its own copy of Node.js, so it stays vulnerable until you rebuild it with a fixed Node.js. Regenerate any --build-snapshot images at the same time to clear CVE-2026-106074.
  4. If you cannot patch today, stop decompressing Brotli from untrusted sources and watch for unexplained crashes. That is the interim advice from Canada’s Cyber Centre (Canadian Centre for Cyber Security). Blocking Brotli-compressed requests at the proxy or firewall is one way to do that (BleepingComputer).
  5. Patch the other Brotli users in your stack: Bun, .NET, Python’s Brotli and brotlicffi, and proxies such as Envoy (Canadian Centre for Cyber Security).
  6. If you are on Node.js 20 or older, there is no community fix. Move to a supported line. Node.js points to paid support from OpenJS Ecosystem Sustainability Program partners for versions past Maintenance LTS (Node.js).

Why this is part of the Vulnpocalypse

The headline bug was reported by an AI security team, sat in a compression library shared by many runtimes, and was on CISA’s exploited list six days after the fix shipped (CISA KEV). Four of the other nine CVEs are incomplete fixes or regressions of earlier Node.js fixes (Node.js). That is the pattern of the Vulnpocalypse: more bugs found faster, and patches that need patches.

The lesson for developers is the same as for PHP2Shell: the bug is in the runtime, not your code, so the fix is an inventory problem. Know every place Node.js runs, including CI images and packaged binaries, and be able to rebuild them all in a day.

Sources