Science & Tech · Cybersecurity · 3 hrs ago
Node.js updates fix 10 security flaws, including a remote code execution risk
The Node.js project released security updates for versions 22, 24 and 26 on October 21.
The updates fix 10 vulnerabilities, including four rated High, though the exact flaws differ by version.
The most serious issue is a Brotli decoder flaw that could allow remote code execution.
Other fixes address weaknesses in DNS handling, TLS certificate checks, file permissions and random-number generation.
The updates also add a blocklist for public keys linked to eMudhra intermediate certificates whose private keys were reported compromised.
This matters for developers because unpatched systems may face security risks, including unsafe connections or code running remotely.
The project recommends updating promptly, and teams should also check applications packaged as single executable files and confirm TLS connections use the fixes.
Node.js released security updates for its 26.x, 24.x and 22.x lines on October 21, 2026, fixing 10 vulnerabilities.
The flaws include four rated High, three Medium and three Low.
The most severe issue is a Brotli decoder out-of-bounds write that could allow remote code execution.
The updates also address TLS certificate validation and DNS resolution flaws.
They include changes responding to the reported compromise of eMudhra intermediate certificate authorities.
- Who
- The Node.js project.
- What
- It released security updates fixing 10 vulnerabilities, including a flaw that could allow remote code execution.
- When
- October 21, 2026.
- Where
- In the Node.js 26.x, 24.x and 22.x release lines.
- Why
- To fix security vulnerabilities and address the reported compromise of eMudhra intermediate certificate authorities.
This story does not have two clearly opposing sides.
This story does not have a timeline yet.
- Release date
- October 21, 2026
- Patched versions
- 22.23.4, 24.22.1 and 26.12.1
- Vulnerabilities fixed
- 10
- Severity breakdown
- 4 High, 3 Medium and 3 Low
- Remote code execution flaw
- CVE-2026-111497, affecting the Brotli decoder
- Affected release lines
- 22.x, 24.x and 26.x
3 sources
Posts on X
【注意】PHPだけじゃない。Node.jsにも深刻度「高」の脆弱性。10月21日に修正版が公開されました。 そもそもNode.jsとは、WebサイトやAIアプリの裏側を動かす「エンジン」のようなもの。ログインやデータ処理など、幅広く使われています。