Node.js Fixes High-Severity Flaws Across Three Release Branches

The Node.js project issued security releases for its 26.x, 24.x and 22.x lines on Oct. 21, fixing 10 vulnerabilities, including a high-severity flaw that can enable remote code execution. Crypto platforms using Node.js in their back-end systems should check which release branch they run.

Tracked as CVE-2026-111497, the flaw is in Brotli decompression and involves an out-of-bounds write. It affects all three branches. The fixes are included in Node.js 26.12.1, 24.22.1 and 22.23.4, respectively.

Four of the 10 issues are high severity, while three are medium and three are low. Other high-severity flaws involve null-byte handling in DNS processing and a weakness in TLS certificate hostname checks.

The releases also address persistent-connection response handling, repeated use of cached random numbers and the permission model, and update c-ares, OpenSSL and Undici. Unsupported Node.js versions may also face security vulnerabilities; users are advised to run a current supported release.