Same release, different risks: CVE-2026-111497 next to nine other Node.js fixes
Security releases bundle unrelated repairs, and a bundled identifier list hides how differently those repairs behave in production. The October 21, 2026 Node.js update is a clean example: one CVE is a memory-corruption bug in a decompressor, while others are logic errors in DNS resolution, TLS hostname verification and HTTP connection reuse.
What the release contains
The advisory lists ten CVEs. Alongside CVE-2026-111497, the Brotli decoder out-of-bounds write, it covers DNS name truncation with NUL bytes, three TLS certificate hostname verification bypasses involving fullwidth digits, leading-zero IPv4 literals and non-canonical hostnames, a keep-alive flaw that accepts a response written before the request, entropy caching in startup snapshots and several permission model issues.
Every one of them sits at a trust boundary. None of them is a business-logic bug.
Why the decoder stands out
CVE-2026-111497 is the only one in the set described as memory corruption. Its mechanism is a decoder that reports an invalid block switch as a need for more input, so a streaming caller keeps appending into an eight-byte internal buffer until the write runs past its end. Consequences range from a crash to remote code execution.
The TLS and DNS issues are logic defects with sharp but narrower effects. A certificate for the wrong IP address can authenticate a connection, which breaks a specific verification assumption rather than corrupting memory. The permission model issues matter to deployments that rely on those controls for isolation.
The practical difference is containment. A logic error in verification is fixed by upgrading the runtime and, where the verification decision was cached or persisted, by invalidating what was decided under the old rules. A memory-corruption bug is fixed by upgrading and by reducing how much untrusted parsing happens inside privileged processes.
Version scope differs across the set
The Brotli flaw affects 22.x, 24.x and 26.x. The fullwidth-digit TLS issue affects only 26.x and 24.x per the advisory, while the leading-zero issue affects all three lines. That makes a line-by-line reading necessary: a team on 22.x has a different exposure profile than a team on 26.x, and a blanket statement about the release is imprecise.
Fixed releases are 22.23.4, 24.22.1 and 26.12.1. End-of-life branches remain affected permanently.
A note on the decoder supply chain
Because the CVE record traces the Brotli defect to library versions 1.0.3 through 1.2.0 in c/dec/decode.c, fixed in 1.0.10, 1.1.1 and 1.2.1, the decoder can also be vulnerable in services that do not run Node.js. The other CVEs in this release are Node.js-specific and do not travel that way.
How to sequence the upgrade
Ship the release as one change, then handle the residual work per CVE. For CVE-2026-111497, confirm the runtime version in the running process and check whether any vendored decompression library predates the fix. For the TLS issues, review whether verification results were cached or logged in a way that now needs invalidation. For the permission model findings, check whether any deployment depended on those controls as a security boundary.
That sequence is boring, and it is the reason it works. The defect behind CVE-2026-111497 was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security and fixed by mcollina and aduh95. Boring releases are still worth reading line by line.
Top comments (0)