Multiple security vulnerabilities have been identified in Node.js, affecting the 20.x version range and other supported release lines. These flaws include a critical out-of-bounds write in the Brotli decompression code and several issues in TLS certificate validation and DNS resolution. The overall risk is high, with the potential for remote code execution and security bypasses in applications that process compressed data or network requests.
CVE-2026-111497: This vulnerability is an out-of-bounds write in the Brotli decoder bundled with Node.js. It is triggered by malformed compressed input and can allow remote code execution on the affected system. The flaw exists in the decompression logic used by the zlib module and fetch operations.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Node.js, affecting the 20.x version range and other supported release lines. These flaws include a critical out-of-bounds write in the Brotli decompression code and several issues in TLS certificate validation and DNS resolution. The overall risk is high, with the potential for remote code execution and security bypasses in applications that process compressed data or network requests.
CVE-2026-111497: This vulnerability is an out-of-bounds write in the Brotli decoder bundled with Node.js. It is triggered by malformed compressed input and can allow remote code execution on the affected system. The flaw exists in the decompression logic used by the zlib module and fetch operations.[emaillocker id="1283"]
CVE-2026-106069: This flaw allows an attacker to bypass TLS certificate checks by writing a server's IP address in an unusual form. This manipulation causes a certificate to match a host it should not, potentially enabling man-in-the-middle attacks. The issue affects the validation logic for hostnames and IP addresses.
CVE-2026-105483: Similar to the previous issue, this vulnerability permits a bypass of TLS certificate validation through an unusual representation of an IP address. An attacker can exploit this to make a certificate appear valid for an incorrect host. The severity is rated high, though exploitation is considered difficult.
CVE-2026-105482: This high-severity flaw involves the dns.resolve function truncating a hostname at an embedded null byte. An attacker could use this to manipulate DNS resolution results. The issue allows for potential security bypasses in applications relying on accurate hostname resolution.
CVE-2026-106074: This medium-severity vulnerability affects applications built as startup snapshots or single-executable applications. It causes crypto.randomUUID and crypto.randomInt to return the same values in every process. This undermines the unpredictability required for secure random number generation.
CVE-2026-105481: This is a medium-severity vulnerability in the Node.js runtime. Specific details regarding the exploitation mechanism are not fully detailed in the provided facts, but it is part of the broader set of fixes released for supported lines. It contributes to the overall security posture of the platform.
CVE-2026-106072: This low-severity vulnerability is part of the security updates for Node.js. While the specific technical details are not elaborated in the known facts, it is addressed in the same release cycle as the higher-severity flaws. It represents a minor security improvement in the runtime.
CVE-2026-106070: This low-severity issue is included in the batch of fixes for Node.js supported versions. The exact nature of the flaw is not specified in the available data, but it is resolved in the latest security updates. It is part of the comprehensive patching effort for the platform.
CVE-2026-106071: This low-severity vulnerability is addressed in the Node.js security release. Details on the specific component or exploitation vector are not provided in the known facts. It is one of the ten flaws fixed in the update for supported release lines.
CVE-2026-106073: This low-severity flaw is part of the security fixes for Node.js. The specific impact and mechanism are not detailed in the provided information. It is included in the set of vulnerabilities patched in the recent security update.
These vulnerabilities collectively present a significant risk to systems running affected versions of Node.js, particularly those handling untrusted compressed data or network communications. Users of end-of-life versions are most at risk as they will not receive fixes. The general action is to upgrade to a supported release line to mitigate these security issues.
The following reports contain further technical details:
[/emaillocker]