Node.js released security updates on October 21 that fix 10 vulnerabilities across the 22.x, 24.x and 26.x lines. The most serious is an out-of-bounds write in the bundled Brotli decoder that Node.js says can allow remote code execution.
The Brotli Decoder Out-of-Bounds Write
Malformed compressed input triggers the flaw, which the Node.js project rated high. It is exposed when an application decompresses attacker-controlled Brotli data through node:zlib or fetch(). The fixes are in Node.js 22.23.4, 24.22.1 and 26.12.1.
Brotli itself shipped fixes the same day in versions 1.2.1, 1.1.1 and 1.0.10, although the source fix was committed in February 2026. Other software that bundles Brotli can be affected as well.
Node2Shell: A Public Proof of Concept With Limited Results
A public proof of concept called “Node2Shell” appeared on October 22. It reached code execution only against a deliberately weakened build. On standard builds, its author saw a crash and a limited memory read. No in-the-wild exploitation has been reported.
Other High and Medium Severity Node.js Fixes
Two high-rated flaws are TLS certificate check bypasses that work through unusual IP address forms, CVE-2026-106069 and CVE-2026-105483. A third high-rated flaw, CVE-2026-105482, involves null byte truncation in dns.resolve.
CVE-2026-106074 and Repeated Random Values
A medium-severity bug, CVE-2026-106074, causes crypto.randomUUID() and crypto.randomInt() to repeat values across processes in snapshot and single executable application builds.
eMudhra Certificate Blocks Included in the Releases
The releases also block the eight compromised eMudhra intermediate certificates and drop three emSign roots. That change ties the Node.js update to the wider response to the eMudhra key exposure, which prompted browsers, Oracle and other runtimes to withdraw trust in the affected certificates this week.
Who Is Affected and Who Gets No Fix
Node.js 20 and earlier are end of life and receive no fix. Any application on a supported line that handles untrusted Brotli data falls within range, though practical remote code execution has not been demonstrated on standard builds.
The distance between the February source fix and the October releases shows that the correction existed in the Brotli code for months before it was packaged into the Node.js security release and published under version numbers for downstream consumers. The Hacker News reported that the project advises moving off Node.js 20 and updating other software that bundles Brotli.
TLS Check Bypasses and dns.resolve Truncation in the Same Release
The two TLS certificate check bypasses, CVE-2026-106069 and CVE-2026-105483, both work through unusual IP address forms, which lets a connection pass validation it should fail. The dns.resolve flaw, CVE-2026-105482, involves a null byte that truncates the value being resolved. All three are rated high, and all three are fixed in the same 22.23.4, 24.22.1 and 26.12.1 builds as the Brotli bug.
Reach Into Applications That Decompress Untrusted Data
The attack path depends on how an application uses its decompression functions. A server that accepts compressed uploads or that fetches content from untrusted hosts, and then decodes Brotli, presents the exposure. The use of node:zlib or fetch() as entry points means the exposure applies to common patterns rather than to a rarely used feature.
State of Exploitation for the Node2Shell Proof of Concept
The public proof of concept narrows the question of exploitability: it achieved code execution only when the build was altered to be weaker, and otherwise produced a crash and a limited memory read. The Node.js project’s own description still lists remote code execution as a possible outcome. The confirmed practical effect on standard builds, as shown by the author, is a crash with a limited memory read.
Supported Release Lines in the October 21 Update
The three fixed versions map to the three supported lines: 22.23.4 for the 22.x line, 24.22.1 for 24.x and 26.12.1 for 26.x. Applications on Node.js 20 or earlier have no equivalent update, because those versions have reached end of life, and the same is true for the other nine fixes in the release batch.
