EDITOR WIRE | 2026-10-21 | BLOCK 972502
BITCOIN $84,524 | GOLD $4,133 | OIL $104.78 | S&P 500 $7,751 | US 10Y 5.12%
Node.js patches Brotli code-execution flaw and TLS verification bypasses
Node.js has released security updates for its 22.x, 24.x and 26.x lines. The highest-severity fixes are rated high. They include an out-of-bounds write in the Brotli decoder that Node.js says can permit remote code execution, two TLS certificate hostname bypasses, and a DNS flaw that truncates names containing a NUL character. The releases also update bundled dependencies and root certificates, including changes related to the eMudhra intermediate CA compromise.
The practical attack paths depend on how an application uses Node.js. A service that decodes attacker-supplied Brotli data could expose its process to the memory-corruption flaw; Node.js identifies remote code execution as a possible outcome, not a demonstrated compromise of every service using Brotli. The TLS flaws could let a malicious endpoint pass hostname checks in the affected non-canonical IP cases, undermining applications that rely on those checks to authenticate a server. The DNS flaw could make an application resolve a different name from the one it intended if untrusted input containing a NUL reaches `dns.resolve()`.
Other fixes address a distinct risk for applications built from startup snapshots or single executable applications: cached values from `crypto.randomUUID()` and `randomInt()` could repeat across processes. If an application uses those values for identifiers or security-sensitive tokens, repetition could cause collisions or weaken assumptions about uniqueness. This does not mean all Node.js random values are predictable.
Operators should update to 22.23.4, 24.22.1 or 26.12.1, as appropriate for their release line, and restart affected services. The fullwidth-digit TLS bypass affects 24.x and 26.x; the Brotli, DNS and other hostname-checking flaws affect all three lines. These are possible attack scenarios based on the disclosed flaws—not evidence of exploitation in the wild.
Sources:
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
https://nodejs.org/en/blog/release/v22.23.4/
https://nodejs.org/en/blog/release/v24.22.1/
https://nodejs.org/en/blog/release/v26.12.1/
BITCOIN $84,524 | GOLD $4,133 | OIL $104.78 | S&P 500 $7,751 | US 10Y 5.12%
Node.js patches Brotli code-execution flaw and TLS verification bypasses
Node.js has released security updates for its 22.x, 24.x and 26.x lines. The highest-severity fixes are rated high. They include an out-of-bounds write in the Brotli decoder that Node.js says can permit remote code execution, two TLS certificate hostname bypasses, and a DNS flaw that truncates names containing a NUL character. The releases also update bundled dependencies and root certificates, including changes related to the eMudhra intermediate CA compromise.
The practical attack paths depend on how an application uses Node.js. A service that decodes attacker-supplied Brotli data could expose its process to the memory-corruption flaw; Node.js identifies remote code execution as a possible outcome, not a demonstrated compromise of every service using Brotli. The TLS flaws could let a malicious endpoint pass hostname checks in the affected non-canonical IP cases, undermining applications that rely on those checks to authenticate a server. The DNS flaw could make an application resolve a different name from the one it intended if untrusted input containing a NUL reaches `dns.resolve()`.
Other fixes address a distinct risk for applications built from startup snapshots or single executable applications: cached values from `crypto.randomUUID()` and `randomInt()` could repeat across processes. If an application uses those values for identifiers or security-sensitive tokens, repetition could cause collisions or weaken assumptions about uniqueness. This does not mean all Node.js random values are predictable.
Operators should update to 22.23.4, 24.22.1 or 26.12.1, as appropriate for their release line, and restart affected services. The fullwidth-digit TLS bypass affects 24.x and 26.x; the Brotli, DNS and other hostname-checking flaws affect all three lines. These are possible attack scenarios based on the disclosed flaws—not evidence of exploitation in the wild.
Sources:
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
https://nodejs.org/en/blog/release/v22.23.4/
https://nodejs.org/en/blog/release/v24.22.1/
https://nodejs.org/en/blog/release/v26.12.1/