Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

Why This Release Needs Attention Now

The four high-severity vulnerabilities impact two areas that nearly every Node.js service interacts with: compressed data and outbound connections.

CVE-2026-111497 is a vulnerability found in the code responsible for decompressing Brotli data. Any service that unpacks Brotli content it did not create is affected by this issue. Additionally, there are three other high-severity vulnerabilities: CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069. These vulnerabilities compromise Node.js’s ability to verify hostnames and certificates, which is especially important for services that connect to hosts on behalf of users.

Three additional points apply to every team:

• No workarounds are available. Node.js has not published any for these ten CVEs. Upgrading the runtime is the solution.
• No CVSS scores are available. Currently, the CVE records are reserved and do not have CVSS scores.
• No updates are available for unsupported lines. Only versions 22.x, 24.x, and 26.x have received fixes. All other versions, including 25.x and 20.x, remain vulnerable and must be upgraded to a supported release.

Why Updating Application Dependencies Is Not Enough

Updating application dependencies alone will not resolve these issues. The vulnerable code is included in the Node.js runtime, which encompasses runtimes embedded in container images and single-executable applications (SEAs).

Node.js also often runs from nonstandard locations:

• Version managers such as nvm
• Application folders
• Bundled runtimes
• SEAs
• Container images, running containers, and serverless functions such as AWS Lambda Node.js runtimes

What the Vulnerabilities Affect

The vulnerabilities span zlib, DNS, TLS, HTTP, crypto, and the Permission Model. Three of the four high-severity issues weaken hostname or certificate validation, which matters for any service that makes outbound TLS or DNS calls on behalf of users.

High-Severity Vulnerabilities

CVE-2026-111497 (Brotli). A crafted Brotli stream can cause the decoder to write outside its allocated memory bounds. Node.js classifies this outcome as a remote code execution vulnerability. Services that decompress Brotli data from untrusted sources, such as HTTP clients and proxies that accept the Content-Encoding: br, or services that handle uploaded compressed files, are particularly at risk.

CVE-2026-105482 (DNS). The functions dns.resolve*, dns.reverse, and the Resolver class send names to c-ares as C strings. Therefore, if an embedded NUL character is present, it will truncate the name. An application has the ability to validate one hostname against an allowlist while querying a different name. The dns.lookup function remains unaffected by this issue.

CVE-2026-106069 (TLS). The `tls.checkServerIdentity` function can verify a non-canonical IP address, such as one in octal or shortened form, against a certificate for one address while the connection is directed to a different one. This vulnerability allows an attacker to present a certificate that is valid for an endpoint that does not actually belong to them.

CVE-2026-105483 (TLS). Hostnames using Unicode fullwidth digits normalize to an IP address and can match a certificate issued for that IP. This issue only affects the 24.x and 26.x lines.

Medium- and Low-Severity Vulnerabilities

• CVE-2026-105481 (Medium, HTTP): With http.Agent keep-alive, a server can send a response through an idle reused socket before the next request, which Node.js will interpret as the response to that request.
• CVE-2026-106072 (Medium, TLS): Certificates with DNS names were accepted for non-canonical IPv4 endpoints. This issue has been resolved in the same commit as CVE-2026-106069.
• CVE-2026-106074 (Medium, crypto): Cached values for crypto.randomUUID and crypto.randomInt were stored in startup snapshots, causing processes that initiated from the same snapshot to produce identical initial values. Only SEAs using useSnapshot or user-land snapshots are affected.
• CVE-2026-106070 (Low, zlib): In the experimental zlib.ZipFile API (added in 26.8.0), a read after a failed header check could return bytes from the wrong file position.
• CVE-2026-106071 (Low, Permission Model): Using Wildcard paths in the --allow-fs-read or --allow-fs-write options may provide access to more files paths than originally intended.
• CVE-2026-106073 (Low, fs): fs.realpathSync bypassed the Permission Model check that its sibling functions perform, allowing calls on ungranted paths.

Node.js by the Numbers: Nine in 10 Installations Are Unpatched or Unsupported

The Qualys Threat Research Unit analyzed anonymized data to measure exposure to the October 2026 Node.js vulnerabilities.

We found 3.3 Node.js package installations, and 15% of them are on internet-facing assets, within reach of remote attackers.

Across those installations:

• 1.3 million run supported lines, Node.js 22, 24, and 26. A fixed release is available for these versions, but it has not been applied yet.
• 1.7 million run end-of-life or end-of-support lines, Node.js 25, 23, 20, and older. These lines get no upstream fix, so moving to a supported line is the only remedy.
• Only 42,000 have been patched so far.

The takeaway: More than half of Node.js installations run versions that will never receive these fixes, and nearly all of the rest have not been patched yet.

Fixed Versions and Upgrade Guidance

Each supported line has a fixed release, and any subsequent release in the same line also includes the fixes.

Node.js version 26 will become LTS on October 28, 2026. Teams using version 26.x should upgrade to version 26.12.1 before this transition.

Simply updating application dependencies does not resolve these issues. The vulnerable code is included with the Node.js runtime, which encompasses runtimes found in container-based images and single-executable applications (SEAs).

What Qualys Customers Can Do

Qualys customers can identify every vulnerable Node.js runtime across hosts, containers, and cloud workloads, and track remediation in a single view. Detections for the October 2026 release are detailed below.

How Qualys Finds and Closes Node.js Exposure

The Qualys Enterprise TruRisk Platform takes teams from advisory to verified fix in five stages, using the inventory and telemetry they already have.

1. Find every runtime with CSAM and Qualys Deep Scan. Deep Scan identifies vulnerable Node.js binaries in custom application folders, secondary drives, and other configured directories. Findings appear in VMDR with the full binary path, installed version, and recommended fixed version. This information provides security and IT teams with the necessary details to locate and address any overlooked installations.
2. Prioritize with Enterprise TruRisk Management (ETM). TruRisk scoring adds asset and exposure context, so teams can start with internet-facing services that decompress untrusted Brotli data (CVE-2026-111497) or open TLS connections to user-supplied hosts (CVE-2026-106069, CVE-2026-105483).
3. Confirm the fix. After upgrading, rescan with Cloud Agent or Container Security and confirm the detection QIDs close.

To build the inventory in step 1, run one CSAM or VMDR query per release line, so patched assets on other lines are not counted:

Run the following queries in CSAM > Inventory > Assets.

Reduce Exposure Before You Patch

Upgrading the runtime is the only complete fix. Node.js has not published workarounds, so the interim steps below come from the Qualys Threat Research Unit (TRU). They narrow specific attack paths; they do not make an unpatched runtime safe.

• Avoid Brotli decompression of untrusted input where possible. Limit compressed payload size and decompression ratio at the reverse proxy or WAF.
• Resolve user-supplied names with dns.lookup instead of dns.resolve*, and reject hostnames containing NUL characters.
• Convert IP addresses to canonical form before they reach a TLS connection. Reject fullwidth and other non-canonical forms.
• Disable keepAlive on http.Agentfor connections to untrusted servers.
• Do not rely on the Permission Model as a security boundary on affected versions.

Patch with Confidence

Node.js has released fixes, and Qualys-published patches are already available in TruRisk Eliminate for the 24.x and 26.x lines. Teams on 22.x should upgrade the runtime manually until a patch is available.

For the 24.x and 26.x patches:

• Patch reliability: High for 24.22.1, Low for 26.12.1. Qualys rates the LTS Upper 24.22.1 patch with a High reliability score, so it’s unlikely to disrupt production. The Node.JS 26.12.1 patch currently carries a Low reliability score, so we recommend staging it with a pilot group before a broad rollout.
• A reboot may be required. Both patches are flagged as “Reboot Maybe Required”, so schedule deployment within a maintenance window.
• Restart every service that runs on Node.js. Long-running processes, containers and SEAs keep the vulnerable runtime in memory until they restart. 

Once the relevant patch is successfully applied, the next VM scan marks the vulnerabilities on that host as closed.

1. Upgrade every copy. Move each supported line to 22.23.4, 24.22.1, or 26.12.1, and migrate end-of-life lines to a supported release.
2. Rebuild what embeds the runtime. Rebuild container images and SEAs on the fixed version, then redeploy them.
3. Restart long-running services, so they load the new runtime.
4. Rescan and verify. Rescan with Cloud Agent or Container Security and confirm the detection QIDs are closed.

Connect Your AI Assistant to Qualys in Three Steps

You can now bring Qualys data into your AI workflows with qualys-cli-mcp, a Model Context Protocol (MCP) server for the Qualys Cloud Platform. Claude, Cursor, VS Code, and other MCP-capable assistants can use it to query your Qualys environment in plain language. For example, you can ask “Can you check in Qualys if I’m vulnerable to CVE-2026-111497 or any of the October 2026 Node.js vulnerabilities?″ without writing API calls or switching consoles.

That’s it. Your assistant can now work across Qualys.

What This Means for Security Teams

The key question we should focus on in this release is not “Are we using Node.js?” but rather, “Where are all the copies, and which ones could an attacker access?” Runtime vulnerabilities can extend across version managers, containers, serverless functions, and various environments, far beyond what standard dependency checks can detect.

With Qualys, teams can identify affected runtimes as soon as advisories are published. They can locate copies that exist outside standard paths, prioritize services exposed to untrusted input, and verify that fixes have been implemented. Detection, prioritization, and verification are all managed on a single platform, eliminating the need to integrate multiple tools.

Reference

Node.js Project: Wednesday, October 21, 2026 Security Releases

Related