Node.js 24.22.1 Fixes a Brotli RCE and 7 Other Security Flaws

Node.js 24.22.1 is a security release, and the worst bug it fixes is a memory flaw in the Brotli decoder that the Node.js project says permits remote code execution. If you run Node 24 in production, you should upgrade now and then check whether you also need to rebuild anything.

The patch shipped on 21 October 2026, alongside 22.23.4 and 26.12.1. Here is what broke, who is exposed, and how to roll it out without surprises.

Key takeaways

• The 21 October 2026 security round fixes 10 CVEs across Node 22, 24 and 26. Eight of them affect the 24.x line.
• Four are rated High: a Brotli out-of-bounds write, two TLS hostname-check bypasses and a dns.resolve truncation bug.
• The bundled certificate store now distrusts the compromised eMudhra intermediate CA.
• No exploitation in the wild had been reported when the patch was released.
• If you ship snapshots or single executable apps, upgrading Node isn’t enough. You also need to rebuild them.

What does Node.js 24.22.1 actually fix?

Release manager Antoine du Hamel published the 24.22.1 ‘Krypton’ LTS release notes on 21 October 2026. LTS means long-term support: the line companies are meant to run in production. The official security advisory lists 10 vulnerabilities across all supported lines: 4 High, 3 Medium and 3 Low.

Two of the Low bugs, in ZIP handling and a Permission Model wildcard lookup, affect only Node 26. That leaves eight that matter for Node 24.

CVE	Area	Severity	What goes wrong
CVE-2026-111497	Brotli	High	Out-of-bounds write in the decoder; permits remote code execution
CVE-2026-105483	TLS	High	Hostname check bypassed with IPs written in fullwidth digits
CVE-2026-106069	TLS	High	Hostname check bypassed when a host loosely resolves to an IP
CVE-2026-105482	DNS	High	dns.resolve truncates names at a NUL character
CVE-2026-105481	HTTP	Medium	Keep-alive socket accepts a response sent before the request
CVE-2026-106072	TLS	Medium	DNS certificate names can authenticate non-canonical IPv4 endpoints
CVE-2026-106074	Crypto	Medium	randomUUID() and randomInt() caches baked into snapshots
CVE-2026-106073	Permissions	Low	fs.realpathSync skips the Permission Model check

The release also updates bundled dependencies: OpenSSL 3.5.9, undici 7.30.1, c-ares 1.34.9, timezone data 2026e, and root certificates from NSS 3.131.1.

Why is the Brotli bug the one to worry about?

Brotli is the compression format behind the br encoding many websites use. An out-of-bounds write means the decoder can write data past the end of its memory buffer. Think of a mail sorter that keeps stuffing letters into the slot next door: with the right input, an attacker can control what lands there.

The risky case is decompressing data you don’t control. In a post-patch review by LFW, the team pointed out that Node unpacks Brotli automatically when it fetches a page. That made their site-audit tool, which loads any URL a visitor types in, the riskiest part of their stack. Crawlers, link previewers, webhook consumers and scrapers fit the same pattern.

Opinion: if your server fetches URLs chosen by strangers, treat this as an upgrade-today bug, not a next-sprint ticket.

How did the TLS hostname tricks work?

TLS hostname checks confirm that a certificate really belongs to the server you meant to reach. The bugs came from IP addresses written in odd but valid-looking forms. An independent test by lilting.ch ran the fix’s own test inputs against 24.22.0 and 24.22.1:

• １２７.0.0.1 (fullwidth digits) matched a certificate for 127.0.0.1 on 24.22.0.
• 127.1, a shorthand form, matched the same certificate.
• 0127.0.0.1 was read as octal and compared against 87.0.0.1, even though the connection went to 127.0.0.1.

All three cases pass on 24.22.0. On 24.22.1, each one fails with “Host is a non-canonical IP address.” The DNS bug is just as easy to picture: on the old build, example.com\0.trusted.corp quietly resolved example.com. The new build throws ERR_INVALID_ARG_VALUE instead.

Is upgrading Node.js 24.22.1 enough on its own?

For most apps, yes. Two cases need more work:

• Snapshots and single executable apps (SEAs). CVE-2026-106074 saved the entropy caches for crypto.randomUUID() and randomInt() into startup snapshots, so every process started from that snapshot repeated the same “random” values. Rebuild those artifacts on 24.22.1, or the old caches ship again.
• Pinned Docker images and lockfiles. A node:24 tag pulled last month is still 24.22.0 or older. Pull it again, rebuild and redeploy.

The certificate change can also catch you out. The bundled CA store now distrusts the compromised eMudhra intermediate CA. SecurityOnline reports that Mozilla, Google and Apple blocked it between 17 and 19 October 2026. If a partner API still uses an eMudhra-issued chain, your calls will start failing with CERT_REVOKED. That is the intended result, but it can look like an outage.

Running Node on serverless? Our explainer on AWS Lambda Web Functions covers how runtime versions get managed there.

What happens next

Several of the fixes point to the private node-private tracker, so the full technical write-ups are not public yet. Once enough servers have patched, expect more detail and possibly proof-of-concept code. Patched teams lose nothing when that happens. Unpatched teams lose their head start.

End-of-life versions get no fixes at all. The advisory says EOL lines are always affected, and the lilting.ch test showed EOL Node 25.3.0 still resolving the NUL-byte name and accepting the eMudhra chain. If you are still on Node 25 or older, move to 24 or 26. A supply-chain scare like the Rank Math PRO backdoor is a reminder of how short the gap between disclosure and abuse can be.

FAQ

Which Node.js versions fix the October 2026 vulnerabilities?

Node.js 22.23.4, 24.22.1 and 26.12.1, all released on 21 October 2026. Every older build on those lines is affected.

Has the Brotli flaw been exploited?

When the patch was released, the Node.js team reported no exploitation in the wild and no public proof-of-concept had been confirmed. That can change once details are published.

Do I need to change my code after upgrading?

Usually not. Code that passes NUL bytes to dns.resolve, connects to non-canonical IP strings over TLS, or trusts eMudhra-issued chains will now get errors. Snapshots and SEAs must be rebuilt.

Your next step: run node -v on every server and image you own. Anything below 24.22.1 on the 24 line goes to the top of the patch list.