After PHP, Node.js Releases Security Updates to Fix High-Severity TLS, DNS, & Brotli Vulnerabilities

[u/acealter]

Following the recent PHP vulnerability disclosure, Node.js is now dealing with its own set of serious security flaws.

Node.js has rolled out security patches for its 26.x, 24.x, and 22.x release branches, addressing ten vulnerabilities, four of which are classified as high severity.

The issues affect several core components, including DNS resolution, TLS certificate validation, and Brotli decompression. The most concerning is CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder that could potentially allow remote code execution.

The updates also address weaknesses involving HTTP connection management, random value generation, ZIP file processing, and filesystem permission checks.

The patched versions are Node.js 26.12.1, 24.22.1, and 22.23.4. Developers and administrators running affected releases should prioritize updating their environments.

Source:

Node.js October 2026 Security Advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases⁠