DEV Community

jeffrey
jeffrey

Posted on

Node.js October 2026: A Brotli Out-of-Bounds Write and Three Ways to Fool Hostname Checks

#node #tls #memorysafety #patching

Node.js October 2026: A Brotli Out-of-Bounds Write and Three Ways to Fool Hostname Checks

The Node.js security release of 21 October 2026 shipped ten CVEs, four rated high. Two of those highs are the kind of bug that survives years of code review because the failing input looks boring: a compressed response body, a hostname written with full-width digits. What follows is a reading guide for teams deciding what to patch first and what to stop running.

The four high-severity issues

CVE-2026-111497 is the memory-safety one. The Brotli decoder writes past the end of a buffer while handling a crafted compressed stream. That places an out-of-bounds write on any path where Node decompresses Brotli content, including the HTTP client and server layers when Brotli content encoding is negotiated. Out-of-bounds writes are the class most likely to become remote code execution, which is why this release is not a routine dependency bump.

The other three highs are hostname verification failures, and they are separate mistakes rather than one root cause.

CVE-2026-105483 affects Node 26 and 24. A hostname containing full-width digit characters can be parsed one way for comparison and another way by the system resolver, so a certificate issued to a name the client never meant to reach still validates.

CVE-2026-106069 affects 26, 24 and 22. When a hostname is loosely parsed as an IP address but is not one, verification proceeds against the wrong representation.

CVE-2026-105482 is a different failure mode in the same family. dns.resolve truncates a name at an embedded NUL byte, so what gets resolved and what gets compared are not the same string.

What the rest of the batch covers

Five medium and low entries complete the release. CVE-2026-105481 is a keep-alive handling flaw. CVE-2026-106072 concerns non-canonical IPv4 forms during certificate validation. CVE-2026-106074 covers an entropy cache that persisted into startup snapshots and single executable applications. CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073 are low-severity issues involving ZipFile prefix bytes, a Permission Model wildcard, and realpathSync.

None of these individually justify an emergency change window. Together they argue for treating the runtime as a component with its own patch cadence, not as infrastructure that was settled once at design time.

The fix matrix

Branch Fixed release Notes
26.x 26.12.1 Carries all four highs
24.x 24.22.1 Carries all four highs
22.x 22.23.4 Carries the Brotli write and the DNS NUL truncation; not the two TLS parsing bugs
20.x unpatched End of life; no release planned
18.x unpatched End of life; no release planned

This is where remediation plans usually go wrong. On 22.x, 22.23.4 closes two of the four highs, including the memory-safety one, but the TLS hostname parsing bugs are not present on that branch. Anyone on 18 or 20 gets nothing, and the exposure includes the out-of-bounds write.

What to check before you claim to be patched

A version string from the runtime binary settles less than it appears to. Three things are worth confirming explicitly.

  1. Whether any process still runs the old binary. Container images rebuilt from a pin file are the usual source of a stale runtime serving traffic while the lockfile says otherwise.

  2. Whether anything terminates TLS outside Node. If a reverse proxy performs certificate validation, the hostname bugs in this batch may be unreachable through that path. The Brotli decoder is still reachable, because content encoding is applied at the application layer.

  3. Whether you call the Brotli API directly. Applications that decompress user-supplied content themselves inherit CVE-2026-111497 no matter which HTTP stack sits in front.

The end-of-life branches

Node 18 and 20 are out of support, so the October batch is not being backported. That leaves two realistic positions: move the runtime, or accept that a public high-severity out-of-bounds write will not receive a fix on your branch. No configuration flag closes it.

Where an upgrade genuinely cannot land this quarter, the useful controls are architectural. Do not decompress untrusted Brotli content in the same process that holds credentials, and do not rely on hostname matching performed by an unpatched runtime.

References

Top comments (0)