Node.js Security Advisory (21 October 2026): 10 CVEs Across 26.x, 24.x, 22.x
On October 21, 2026, the Node.js Security Team released critical security patches addressing ten vulnerabilities across active release branches. Four vulnerabilities are rated HIGH severity, including a heap out-of-bounds write in node:zlib enabling potential Remote Code Execution (CVE-2026-111497) and TLS hostname verification bypasses (CVE-2026-106069). Threat Sentinel discovered 2 exposed customer estates and staged zero-downtime container image updates.
đź“‹ Executive Threat Briefing
The primary vulnerability, CVE-2026-111497 (CVSS 8.1), is an out-of-bounds write in the Brotli decompression routines of Node’s internal node:zlib wrapper. When an HTTP service accepts compressed request payloads or decompresses untrusted input streams, crafted Brotli chunks can overwrite heap boundaries, triggering service termination or potential arbitrary code execution.
In addition, CVE-2026-105482 (CVSS 7.5) introduces a NUL-byte truncation vulnerability in dns.resolve(), allowing SSRF filter bypasses, while CVE-2026-106069 (CVSS 7.4) permits hostname verification evasion when connecting to upstream microservices via custom TLS configurations.
Sovereign Operational Risk Index Breakdown
Vulnerability Breakdown (10 CVEs)
| CVE Identifier | Severity | Component | Technical Description |
|---|---|---|---|
CVE-2026-111497 |
HIGH (8.1) | node:zlib (Brotli) |
Out-of-bounds write in Brotli decompression enabling heap corruption and remote code execution. |
CVE-2026-105482 |
HIGH (7.5) | node:dns |
NUL-byte truncation in dns.resolve() bypasses domain allowlist validation. |
CVE-2026-106069 |
HIGH (7.4) | node:tls |
TLS certificate hostname verification bypass under specific SNI handshakes. |
CVE-2026-105483 |
HIGH (7.1) | node:crypto |
Improper wildcard Subject Alternative Name (SAN) evaluation in client certificates. |
CVE-2026-105484 |
MEDIUM (5.8) | HTTP Keep-Alive | Connection reuse race condition in Keep-Alive parser triggering HTTP request smuggling. |
CVE-2026-105485 |
MEDIUM (5.3) | V8 Snapshots | Cryptographic entropy insufficiency in pre-compiled startup snapshots. |
Affected & Patched Release Branches
| Release Line | Vulnerable Range | Fixed Release | Status |
|---|---|---|---|
| Node.js 26.x (Current) | v26.0.0 – v26.1.0 | v26.2.0 | Active — Patches available |
| Node.js 24.x (LTS) | v24.0.0 – v24.11.0 | v24.12.0 | Recommended production upgrade |
| Node.js 22.x (LTS) | v22.0.0 – v22.10.0 | v22.11.0 | Recommended production upgrade |
Threat Sentinel Autonomous Response Timeline
| Elapsed | Autonomous Action | Result |
|---|---|---|
| T+0m | Security Release Ingestion | Advisory ingested. High severity Brotli RCE parsed. Evaluated against Sovereign Risk Index (Score: 74.8). |
| T+3m | Container & Runtime Asset Sweep | Scanned 42 sovereign containerized workloads across Docker and Kubernetes clusters. |
| T+7m | Estate Exposure Confirmation | Identified 2 client microservices running unpatched Node.js 22.10.0 and 24.8.0. |
| T+11m | Automated Image Staging & Smoke Test | Staged upgraded base images (node:22.11.0-alpine) and ran integration test suites. |
| T+15m | Executive Assurance Brief Published | White-glove executive assurance brief published to sovereign Client Rooms for deployment approval. |
Verified Mitigation Playbook
Step 1: Update Dockerfile Base Images
Update production container definitions to pull the official patched security tags:
# For Node 24.x LTS: FROM node:24.12.0-alpine # For Node 22.x LTS: FROM node:22.11.0-alpine
Step 2: Re-lock Package Dependencies
npm audit npm rebuild
Step 3: Verification & Runtime Assertion
node -v # Assert returns v22.11.0+, v24.12.0+, or v26.2.0+
Sovereign Protection
Do you have unpatched Node.js containers in production? Threat Sentinel provides automated container estate scanning and non-breaking upgrade staging.