BLACKOUT MAP
All articlesFollow @Blackoutmap_net on X

Security · · 621 views

Node.js security release: ten fixes, one that can run code

Share
Updated 23 October, 22:00 UTC
  • Debian 12 has the Brotli fix (DLA-4855-1), Debian 13 not yet. Google, which issued the CVE, rates the Brotli flaw critical (9.2). Still no reported attacks, and none of the flaws is on CISA's list of exploited vulnerabilities.
  • Bun has the Brotli fix since version 1.4.4 (released this morning). Debian still hasn't shipped an updated brotli package.
  • The Brotli flaw (CVE-2026-111497) is in Google's Brotli library itself: Brotli 1.2.1, 1.1.1 and 1.0.10 fix it. Added: fetch() is a way in, Node from Debian's own packages needs the system brotli update instead, and Bun had not shipped its fix yet.
  • First version.

On the same day PHP shipped its fix for PHP2Shell, the Node.js project released security updates for all three of its supported lines. Ten flaws are fixed, four of them rated high. One, in the Brotli decoder, is described as allowing remote code execution. Node.js powers a large share of web back-ends, APIs and developer tools, so this one is worth a look too.

Status on 23 October 2026

The fix is out: Node.js 22.23.4, 24.22.1 and 26.12.1, and for the Brotli flaw also Google's Brotli library 1.2.1, 1.1.1 and 1.0.10. No attacks in the wild have been reported, no working exploit code has been published, and none of the ten flaws is on CISA's list of exploited vulnerabilities. Debian has fixed Brotli for Debian 12; Debian 13 is still waiting. Versions that have reached their end of life (such as 20.x and older) get no fix from Node.js.

Update: the Brotli flaw is not only Node's

Node's fix for CVE-2026-111497 is a copy of a change to Google's own Brotli library: a decoder fix titled "Detect and report invalid stream earlier". On 21 October at 19:27 UTC, after Node's release, Google published Brotli 1.2.1, 1.1.1 and 1.0.10, each listing the same CVE. So the bug sits in the library that many programs use to unpack Brotli, and each of them needs its own update:

  • Bun, another JavaScript runtime, ships its own copy of the Brotli decoder. A bug report on 21 October said it lacked the fix; Bun updated its Brotli copy overnight and released it in Bun 1.4.4 on 22 October (10:11 UTC). Its release notes don't name the CVE, but the change is in that release.
  • Node from Debian's own packages uses the system's Brotli library instead of its own copy (Debian builds it with --shared-brotli). There the fix has to come through the brotli package (libbrotli1), not through a Node release. Debian has since fixed it for Debian 12 (brotli 1.0.9-2+deb12u1, advisory DLA-4855-1); Debian 13 and testing were still waiting for theirs when we last checked (23 October, 22:00 UTC). Debian's own Node packages are 18.x (Debian 12) and 20.x (Debian 13), lines Node.js itself no longer supports: Debian patches those itself. Node from nodejs.org, NodeSource or the official Docker images carries its own copy and is fixed by updating Node.
  • Other programs that unpack Brotli with the system library get the fix when your distribution updates brotli.

When are you exposed? Node does not unpack Brotli on its own (Vercel). You are exposed when your code, or a library you use, unpacks Brotli data that someone else controls, and that includes fetch(): it unpacks responses sent with Content-Encoding: br automatically, so a malicious or hacked server that your app fetches from can deliver the attack. A firewall in front of your app can't help there, because it sees incoming requests, not the responses your app fetches. Vercel put firewall rules in front of its customers' apps and says itself that "only the runtime patch covers fetched responses".

What was fixed

The Node.js advisory lists the flaws by title and severity. In plain words:

  • Brotli decoder out-of-bounds write (CVE-2026-111497, high; Google, which issued the CVE, rates it critical at 9.2). Brotli is a compression format used by websites and HTTP. A bug in Node's decoder can write outside the memory it should, which the advisory says "permits remote code execution". It affects 22.x, 24.x and 26.x. The bug is in Google's Brotli library itself, and fetch() is one way in (see the update above).
  • Two ways around TLS hostname checks (CVE-2026-105483 and CVE-2026-106069, high). TLS checks that a server's certificate belongs to the name you connected to. In some cases, with an IP address written in fullwidth digits (24.x and 26.x only) or a host name that "loosely" resolves to an IP address, that check could be fooled, which can help someone in the middle pose as another server.
  • dns.resolve cut short at a NUL character (CVE-2026-105482, high). A name containing a hidden zero byte was looked up as a shorter, different name: a classic way to slip past allow-lists that check names.
  • Three medium issues. A keep-alive connection could take a response that was sent before the request (CVE-2026-105481); certificates for a host name could be accepted for an IP address written in an unusual form (CVE-2026-106072); and programs built from startup snapshots or as single executables repeated the same "random" values from crypto.randomUUID() and randomInt() in every run (CVE-2026-106074).
  • Three low issues in the ZIP reader (26.x) and in the optional Permission Model (CVE-2026-106070, 106071, 106073).

The release also updates bundled libraries: c-ares (DNS), Undici (the HTTP client behind fetch), OpenSSL on 22.x and 24.x, SQLite on 22.x, and the built-in list of trusted certificates, which now drops the compromised eMudhra intermediate certificates.

Ad Get 70% off Proton VPN

How this compares with PHP2Shell

PHP2Shell

  • Two critical flaws (9.2), reachable with one ordinary upload request, before any application code runs.
  • Code execution confirmed by PHP; attacks seen in the wild on release day.
  • Details leaked before the fix was out.

Node.js

  • Four high flaws, most of them only reachable in specific uses (Brotli data, TLS to IP addresses, DNS names from users).
  • No reported attacks, no public exploit.
  • A planned release, with no details out in advance.

So: update, but this is a normal security release rather than an emergency. The Brotli flaw is the one to prioritise if your service unpacks compressed data that strangers can send it, or fetches from servers you don't control.

If you run Node.js: what to do

  1. Check your version with node -v, on servers and in containers. Docker images and CI pipelines often pin an old version.
  2. Update to 22.23.4, 24.22.1 or 26.12.1. If you install Node from your Linux distribution or a package repository, wait for its build and check its advisory. Electron apps and other programs that ship their own copy of Node need their own update.
  3. Using Debian's or Ubuntu's own nodejs package? Update the system brotli package (libbrotli1) to the fixed version: on Debian 12 that is 1.0.9-2+deb12u1; on Debian 13 and other distributions, as soon as they ship it. Updating Node alone doesn't cover the Brotli flaw there.
  4. Using Bun? Update to 1.4.4 or later (bun upgrade).
  5. On 20.x or older: these lines no longer get fixes. Plan the move to 22 or 24 (the current long-term support line).
  6. Rebuild single executables and snapshots after updating, so they stop repeating the same random values.

What Blackout Map will watch

Like PHP2Shell, this is a software flaw, not an outage, and it won't show on our map. Our Security watch follows CISA's catalogue of exploited flaws: if any of these are added to it, they will show up there by themselves. Read also our explainer Can a software flaw take the internet down?

Sources

Share this article

Blackout Map is a live map of internet outages and shutdowns around the world. Open the map · Security watch · RSS · Follow us on X: @Blackoutmap_net

All articles

Keep reading

Security · 21 Oct 2026 15,315PHP2Shell: what we know about the two critical PHP flaws (fix out)Two critical flaws in PHP, the language behind about 70% of websites, can let anyone run code on a server with one request. The fix is out: how the attack works, what is confirmed, what to do, and what it could mean for the internet. Explainer · 21 Oct 2026 115Can a software flaw take the internet down?Ten years after the Mirai attack on Dyn: how security flaws turn into outages, the times they did, and what Blackout Map can and cannot see.

More from the blog

Analysis · 24 Oct 2026LaLiga's IP blocks: why half a million websites break in Spain on match daysTo fight pirate football streams, Spain's ISPs block shared IP addresses during LaLiga matches, and hundreds of thousands of unrelated websites go down with them. What OONI found, what we measured, and what you can do before Barcelona – Real Madrid. Retrospective · Iran, February 2026 200Iran's wartime blackout: 88 days cut off from the worldFrom the first strikes on 28 February to 26 May 2026, Iran was almost completely cut off from the internet: 2,093 hours, the longest nationwide shutdown on record. What happened, how it worked and what it cost. Retrospective · West Africa, March 2024West Africa lost four undersea cables in one dayA suspected underwater landslide off Côte d'Ivoire broke four cables at once in March 2024. Ghana was in blackout for almost a week, Côte d'Ivoire fell to 1% of normal. Retrospective · Canada, July 2022How a maintenance update took down Canada's RogersIn July 2022 one update in Rogers' core network cut mobile, home internet, debit payments and emergency calls for millions of Canadians for most of a day. Retrospective · Tonga, January 2022Tonga: the volcano that cut a country offThe 2022 Hunga Tonga eruption shredded the only cable linking Tonga to the world. The country was almost completely offline for five weeks. Retrospective · Worldwide, October 2021The six hours Facebook disappeared from the internetIn October 2021 one routine command took Facebook, Instagram and WhatsApp off the internet for billions of people. No attack, no country outage. Retrospective · Myanmar, February 2021Myanmar 2021: a coup, and an internet curfewAfter the February 2021 coup, Myanmar's military cut the internet nationwide, then every night, then all mobile data: a shutdown shaped by the hour. Retrospective · Tigray, Ethiopia, November 2020Tigray: two years without a connectionFrom November 2020, the war in Ethiopia's Tigray region came with a phone and internet blackout that lasted about two years. Retrospective · Iran, November 2019Iran, November 2019: a country offline for a weekDuring the 2019 fuel protests Iran cut itself off from the internet almost completely, while keeping parts of its domestic network running. Retrospective · Jammu and Kashmir, India, August 2019Kashmir: 550 days without full internetThe shutdown that began in August 2019 became the longest ever imposed in a democracy. High-speed mobile internet only returned in February 2021. Retrospective · Egypt, January 2011Egypt 2011: the night a country switched off its internetIn January 2011, two days into mass protests, Egypt withdrew almost all its routes from the internet within minutes. It stayed dark for five days. Retrospective · Pakistan, February 2008The day Pakistan took YouTube offline for the whole worldIn 2008 a national block on YouTube leaked into the internet's routing system and made the site unreachable worldwide for about two hours.