Node.js Releases Security Updates to Fix High-Severity TLS, DNS, and Brotli Vulnerabilities

Home Cyber Security Node.js Releases Security Updates to Fix High-Severity TLS, DNS, and Brotli Vulnerabilities By Abinaya October 21, 2026 Node.js has released security updates for its 26.x, 24.x, and 22.x branches to address ten vulnerabilities, including four high-severity flaws affecting DNS lookups, TLS certificate checks, and Brotli decompression.

The supplied release details identify 26.12.1, 24.22.1, and 22.23.4 as the patched versions. The most serious potential outcome is remote code execution through the Brotli decoder. The October security update also covers HTTP connection handling, repeated random values, ZIP processing, and filesystem permission checks.

Node.js scheduled the releases for October 21, 2026, and listed high severity as the highest risk across all three supported branches. CVE-2026-111497 affects the Brotli decoder in all three release lines. The supplied advisory describes an out-of-bounds write that permits remote code execution. This means the decoder can write outside its intended memory area.

Applications that process untrusted Brotli-compressed content should receive particular attention during patch planning.…

Abbreviated excerpt as provided by the publisher; the full article is at the canonical source. Attributed to Cyber Security News · Limited verification; verify facts against the linked source. Read the full article on cybersecuritynews.com.

Source published: 21 Oct 2026, 10:03 PM IST. Source facts take precedence over AI interpretation.