Node.js October 2026 Security Release — Exposure Check
With its 21 October 2026 security release, Node.js fixed 10 CVEs, including CVE-2026-111497, a Brotli-related remote code execution flaw. Fixed versions: 22.23.4, 24.22.1 and 26.12.1. Enter your website address and instantly see its risk status based on externally visible signals.
Enter one address per line (up to 10 per submission). For each address the tool sends at most 6 ordinary visit requests: the address you enter, any redirects and a page that does not exist. It looks at the response headers and page source; it makes no attack or exploit attempt. Only enter addresses you own or are authorised to check.
The 10 flaws in the release
All of them are fixed by the same versions: 22.23.4, 24.22.1 and 26.12.1. None can be detected for certain from outside; the definitive answer is the Node.js version on the server.
| CVE | Description | Severity | Affected lines |
|---|---|---|---|
| CVE-2026-111497 | Remote code execution through an out-of-bounds write in the Brotli decoder. Triggered when Node.js decompresses Brotli data: servers that accept br-compressed request bodies, applications that fetch external content with HTTP clients such as fetch, and code that decompresses external data with zlib. | High | 22.x, 24.x, 26.x |
| CVE-2026-105482 | dns.resolve improperly handles domain names containing NUL characters. | High | 22.x, 24.x, 26.x |
| CVE-2026-105483 | TLS certificate hostname verification bypass when IP addresses contain fullwidth digits. | High | 24.x, 26.x |
| CVE-2026-106069 | TLS certificate hostname verification bypass when a hostname loosely resolves to an IP address. | High | 22.x, 24.x, 26.x |
| CVE-2026-105481 | Keep-alive sockets process a response that was written before the request was sent. | Medium | 22.x, 24.x, 26.x |
| CVE-2026-106072 | Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints. | Medium | 22.x, 24.x, 26.x |
| CVE-2026-106074 | Entropy caches used by crypto.randomUUID() and randomInt() are preserved in startup snapshots and single executable applications (SEAs), potentially causing repeated values across processes. | Medium | 22.x, 24.x, 26.x |
| CVE-2026-106070 | ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation. | Low | 26.x |
| CVE-2026-106071 | Filesystem permission over-grant caused by wildcard radix lookup in the Permission Model. | Low | 26.x |
| CVE-2026-106073 | Permission Model bypass through fs.realpathSync. | Low | 22.x, 24.x, 26.x |