Node.js security release: what to do
On 21 October Node.js fixed ten vulnerabilities, seven of them in all three supported lines. The most serious, rated High, is in its Brotli decoder, and Node.js says it permits remote code execution. Node.js 18, 20 and 25 are end-of-life and get no fix. Here is who is exposed and what to do.
By Chris at OnComp · Published · Last verified
- CVE-2026-111497
- High
- CVSS score
- Not published
- Fixed in
- 26.12.124.22.122.23.4
- Node.js 18, 20, 25
- No fix: end-of-life
- Fixes in the release
- 4 High · 3 Medium · 3 Low
Are you exposed?
Who needs to act first
Express 5 apps that read request bodies
Update now
Express 5's body parsers (express.json, urlencoded, text, raw) decode Brotli-compressed request bodies by default, before your code runs. Express 4's parsers don't decode Brotli. Source
Apps that fetch from servers they don't control
Update now
Node's built-in fetch() decodes any response marked Content-Encoding: br. Webhook senders, link previews, scrapers, feed and image fetchers, proxies, and any third-party API that could be compromised all count. Source
Fastify apps using @fastify/compress
Update now
The plugin decompresses request bodies by their Content-Encoding header, Brotli included, unless you restrict it. Source
Anything on Node.js 18, 20 or 25
Upgrade
End-of-life lines get no fix. Node.js says end-of-life versions are always affected when a security release occurs. Source
Everything else on Node.js 22, 24 or 26
Update
Update anyway: the release also fixes TLS hostname checks and DNS handling that any app can rely on without knowing it. Source
Fixed versions
Which Node.js you need
| Line | Fixed in | Status |
|---|---|---|
| Node.js 26 | 26.12.1 | Current; becomes LTS on 28 October 2026 |
| Node.js 24 | 24.22.1 | Long-term support |
| Node.js 22 | 22.23.4 | Long-term support |
| Node.js 25 | No fix | End-of-life since 1 June 2026 |
| Node.js 20 | No fix | End-of-life since 30 April 2026 |
| Node.js 18 | No fix | End-of-life since 30 April 2025 |
“It's important to note that End-of-Life versions are always affected when a security release occurs.” Node.js
Your hosting
Who updates Node.js for you
Your own server, VPS or Docker host
Who updates
You
Install 26.12.1, 24.22.1 or 22.23.4, or rebuild your images from the fixed official image, then restart every Node.js process.
AWS Lambda
Who updates
AWS, for managed runtimes
Managed runtimes update automatically by default. Container-image functions don't: rebuild them from the updated base image and redeploy.
Vercel
Who updates
Vercel
Vercel says it rolls out patch updates itself to fix security issues. Node.js 20 and older are no longer offered there.
Heroku and similar platforms
Who updates
You, by redeploying
Heroku made the fixed versions available for builds on 21 October. Your app runs the old one until it is rebuilt.
A static site built with Node.js
Who updates
Your build machine
If Node.js only builds the site and the result is plain files, visitors never reach Node.js. Update the build machine or CI image anyway.
“To update runtime versions for container-based functions, you must create a new container image from the updated base image and redeploy your function.”
“Vercel automatically rolls out minor and patch updates when needed, such as to fix a security issue.”
The full release
All ten fixes
| CVE | Rating | Issue | Lines |
|---|---|---|---|
| CVE-2026-111497 | High | Brotli decoder out-of-bounds write permits remote code execution | 26, 24, 22 |
| CVE-2026-105482 | High | dns.resolve truncates names containing a NUL character | 26, 24, 22 |
| CVE-2026-106069 | High | TLS certificate hostname bypass when the host loosely resolves to an IP address | 26, 24, 22 |
| CVE-2026-105483 | High | TLS certificate hostname bypass when the IP is written in full-width digits | 26, 24 |
| CVE-2026-105481 | Medium | A keep-alive socket can process a response written before the request was sent | 26, 24, 22 |
| CVE-2026-106072 | Medium | Non-canonical IPv4 hostnames let DNS names in a certificate authenticate IP endpoints | 26, 24, 22 |
| CVE-2026-106074 | Medium | crypto.randomUUID() and randomInt() repeat values in startup snapshots and single-executable apps | 26, 24, 22 |
| CVE-2026-106070 | Low | ZipFile returns attacker-controlled prefix bytes after a failed header check | 26 |
| CVE-2026-106071 | Low | Permission Model filesystem over-grant via wildcard lookup | 26 |
| CVE-2026-106073 | Low | Permission Model bypass with fs.realpathSync | 26, 24, 22 |
Source: Node.js: Wednesday, October 21, 2026 Security Releases.
Exploitation
Is it being exploited?
We found no reports of exploitation and no public exploit as of 21 October, 23:40 BST. The fix itself is public, which usually shortens the time to one.
CVE-2026-111497 is not in CISA's Known Exploited Vulnerabilities catalogue, and no CVSS score has been published for it yet.
No UK, EU or US agency had issued Node.js-specific advice. The NCSC, CISA, NSA, CERT-EU and ENISA statements of 21 October are about PHP.
As of 21 October 2026, 23:40 BST. We update this section when it changes.
Free check
What does your site run on?
One normal page load shows whether a site runs Express, Next.js or PHP. It can't show the Node.js version: that needs a look at the server.
Free. One normal page load of your home page, nothing more. How the check works
Need it done?
Updated, verified and signed off
We update Node.js on servers and in Docker images, check the Brotli exposure, confirm what your platform runs, and move apps off Node.js 18 and 20. Every job ends with a dated sign-off.
- Platform and runtime confirmation£195
- Patch and verify, per app or server£450
- Priority: work starts within 4 working hours£750
- Upgrade an app from Node.js 18 or 20£795
- Patch Watch, per server, monthly£249
- Fixed prices, excluding VAT.
Questions
What teams are asking
Is this as serious as PHP2Shell?
Node.js rates its worst fix High, where PHP rated PHP2Shell critical, and whether the Brotli bug can reach your app depends on what the app does with compressed data. But the fix is public, Node.js says the bug permits remote code execution, and an Express 5 app decodes compressed request bodies by default. Treat it as this week's job, not next quarter's.
Does my Next.js site need updating?
If it runs on your own server or in Docker, yes: update Node.js and rebuild. On Vercel, Vercel says it rolls out Node.js patch updates itself; check your project's Node.js version is 22 or newer, because 20 and older are end-of-life. A site exported as static files only uses Node.js to build.
Can you tell from outside whether my site is affected?
Only partly. A normal page load can show that a site runs Express or Next.js, but Node.js never reports its version, and whether the app decodes Brotli is invisible from outside. Sending a site malformed Brotli to find out would be an attack, so we don't. A check on the server, with your permission, gives the answer.
Is there a workaround until we can upgrade?
Node.js published none. Options that narrow the exposure, which we'd use only as a bridge: set inflate: false on Express 5's body parsers, restrict @fastify/compress to gzip, reject requests with Content-Encoding: br at your proxy, and limit outbound fetch() to hosts you trust. Asking servers for uncompressed responses does not help: fetch() decodes whatever the server sends.
We're on Node.js 20. Is that really unsupported?
Yes, since 30 April 2026. In Node.js's words: “When a version reaches End-Of-Life, it means that it will no longer receive updates, including security patches.” Paid extended support exists as a bridge; the fix is moving to Node.js 24, or 26 once it becomes long-term support on 28 October.
Does this affect anything besides Node.js?
The bug is in Google's Brotli library, which Node.js bundles. Brotli released fixed versions 1.2.1, 1.1.1 and 1.0.10 the same day, so other software that bundles Brotli may need its own update.
Same day, separate issue
PHP2Shell: what UK website owners need to do
Two critical flaws in PHP itself, fixed the same day. Unrelated to the Node.js release.
Read the PHP2Shell guide
Patch Watch
Every security release we're tracking
What's out, what's coming, and the plan that tells you before release day.
See security releases
Sources
Where this comes from
- Node.js: Wednesday, October 21, 2026 Security Releases
- undici (Node.js fetch) source: response decoding
- Node.js: End-of-Life
- Node.js: release schedule
- google/brotli releases
- body-parser (Express 5) README
- @fastify/compress README
- AWS Lambda: runtime version updates
- Vercel: Node.js versions
- Heroku: Node.js 26.12.1, 24.22.1 and 22.23.4 available
- Docker Hub: official node images
- NVD: CVE-2026-111497
- CISA Known Exploited Vulnerabilities catalogue
About this page. Written by Chris at OnComp, a web and IT consultancy in Shoreditch, London. Every fact links to its source and was re-read at the “last verified” time above. Where we explain how the Brotli bug is reached, that is our reading of the libraries' documentation, not a statement from Node.js.