Latest Node.js Vulnerabilities Discovered in October 2026

On October 21, 2026, the Node.js security team published a critical security release addressing 10 distinct vulnerabilities across all actively supported release lines. The most severe flaw, dubbed Node2Shell (CVE-2026-111497), stems from an out-of-bounds write buffer overflow within the bundled Brotli decompression library, carrying a high-to-critical CVSS score. This memory corruption error allows remote attackers to trigger severe denial-of-service conditions or achieve full Remote Code Execution (RCE) by sending malformed Brotli-compressed payloads to endpoints that decompress untrusted input.

In addition to Node2Shell, the release patches multiple high-severity networking vulnerabilities that compromise host authentication and certificate verification. Specifically, CVE-2026-105482 causes domain validation bypasses due to NUL character truncation in DNS resolution. Furthermore, CVE-2026-106069 and CVE-2026-105483 expose TLS connections to Man-in-the-Middle (MITM) attacks by improperly validating certificates against non-canonical IP formats or Unicode fullwidth digits. Lower-severity fixes in this release also resolve issues involving duplicate entropy in "crypto.randomUUID()", HTTP keep-alive request handling, and filesystem permission model bypasses.

To mitigate these security threats, organizations must immediately upgrade their Node.js environments to the latest patched releases: 26.12.1, 24.22.1, or 22.23.4. Unsupported End-of-Life (EOL) versions, such as Node.js 20.x or earlier, will not receive vendor security patches and must be migrated to active LTS branches without delay. Following runtime updates, all serverless functions, container images, and process managers (such as PM2 or systemd) should be rebuilt and restarted to remove vulnerable binaries from active system memory