Multiple High-Severity Vulnerabilities Affecting Node.js (TLS, DNS, and Brotli Decompression)

Node.js is an open-source, cross-platform JavaScript runtime environment commonly used to build scalable network applications, web servers, microservices, and backend APIs across corporate environments.

The released security maintenance updates resolve ten vulnerabilities across the runtime and its embedded core libraries:

• CVE-2026-111497 (High): An out-of-bounds memory write vulnerability in the Brotli decompression module affecting Node.js 26.x, 24.x, and 22.x. An attacker supplying crafted Brotli-compressed data can cause memory corruption, potentially leading to arbitrary remote code execution or application crash.
• CVE-2026-105483 (High): TLS certificate hostname verification bypass when an IP address contains full-width digits, affecting Node.js 26.x and 24.x release branches.
• CVE-2026-106069 (High): TLS hostname validation flaw involving hostnames that loosely resolve to an IP address, impacting all supported branches (26.x, 24.x, 22.x) and allowing man-in-the-middle spoofing.
• CVE-2026-105482 (High): The dns.resolve function truncates domain names containing a NUL character, leading to name resolution inconsistencies and security check bypasses across all branches.
• CVE-2026-105481 (Medium): HTTP connection handling flaw where a keep-alive socket can process a response written before its corresponding request was transmitted.
• CVE-2026-106072 (Medium): Improper certificate validation for non-standard IPv4 hostnames allowing DNS certificate names to authenticate arbitrary IP endpoints.
• CVE-2026-106074 (Medium): Entropy repetition flaw in cached random data within startup snapshots and single executable applications (SEA), causing repeated values from crypto.randomUUID() and crypto.randomInt().
• CVE-2026-106070 (Low): Attacker-controlled bytes returned following failed ZIP archive header checks in Node.js 26.x.
• CVE-2026-106071 (Low): Excessive filesystem access granted through wildcard pattern matching under the experimental Permission Model in Node.js 26.x.
• CVE-2026-106073 (Low): Permission Model restriction bypass via fs.realpathSync across all supported release lines.

These updates also include patched versions of embedded third-party dependencies, including OpenSSL, c-ares, Undici, SQLite, and updated trusted root CA certificates.

• Node.js 26.x: versions prior to 26.12.1;
• Node.js 24.x: versions prior to 24.22.1;
• Node.js 22.x (LTS): versions prior to 22.23.4;
• All end-of-life (EOL) Node.js release branches (such as 20.x, 18.x, and earlier) which no longer receive security maintenance patches.