Node.js: ten vulnerabilities fixed, four rated high severity
Node.js 22.23.4, 24.22.1 and 26.12.1 fix 10 vulnerabilities, 4 rated high: possible bypass of security checks and remote code execution.
On 21 October 2026 CERT.LV, Latvia’s national CSIRT, flagged the October Node.js security releases: 10 vulnerabilities in the JavaScript runtime fixed in the 22.x, 24.x and 26.x lines, four of them rated high severity. heise Security and The Hacker News also covered the news. The versions to install are 22.23.4, 24.22.1 and 26.12.1 or later.
Among the available sources, only the CERT.LV advisory gives the details: for heise Security and The Hacker News we report what their headlines say. None of the available sources maps the individual CVEs to the affected components.
What happened
According to CERT.LV, the Node.js maintainers have published updates fixing several vulnerabilities in the runtime. Depending on the vulnerability and the application’s configuration, an attacker could:
- bypass security checks and access restrictions;
- cause incorrect data handling;
- execute arbitrary code remotely.
The Hacker News focuses on a flaw in the Brotli decoder that, according to the outlet, could allow remote code execution in all supported versions: among the available sources, the Brotli detail is reported only by The Hacker News. heise Security speaks of high-risk flaws and distinguishes between those in Node.js’s own code and “inherited” ones.
Technical details
The ten CVEs listed by CERT.LV, by severity:
| Severity | CVE |
|---|---|
| High (4) | CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497 |
| Medium (3) | CVE-2026-105481, CVE-2026-106072, CVE-2026-106074 |
| Low (3) | CVE-2026-106070, CVE-2026-106071, CVE-2026-106073 |
Fixed versions, according to CERT.LV:
- Node.js 22.23.4 and later (22.x line);
- Node.js 24.22.1 and later (24.x line);
- Node.js 26.12.1 and later (26.x line).
The sources give no CVSS scores, nor do they say which of the four high-severity CVEs concerns the Brotli decoder. In Node.js, Brotli decompression is provided by the zlib module (for example zlib.brotliDecompress() and zlib.createBrotliDecompress()) and is used by applications and libraries that handle br-encoded content. The exact exploitation conditions should be checked in the official Node.js bulletin on the October 2026 security releases, which CERT.LV links to.
CERT.LV also points out that End-of-Life versions may be exposed, because they no longer receive regular security updates. The advisory lists only the 22.x, 24.x and 26.x lines.
MITRE ATT&CK (our classification, not given by the sources): T1190 (Exploit Public-Facing Application) for code execution in exposed Node.js-based services.
eMudhra certificates: a point to check
According to some reports, the release also blocks the certificates of eMudhra’s intermediate CAs, but the texts of the available sources do not describe this. Node.js ships its own list of root certificate authorities, separate from the operating system’s: if your Node.js applications open outbound TLS connections, check the release notes to see whether the bundled list has been updated.
Impact for European and Italian companies
Node.js underpins many web backends, APIs, microservices, serverless functions, build tools and CI/CD pipelines, and is bundled in many applications. Several copies of the runtime often coexist: distribution packages, container images, version managers on developers’ machines, applications that ship their own Node.js. Each has to be updated separately, and the inventory is usually the longest step.
For NIS2 entities, vulnerability handling is among the measures required by Article 21 of the directive: a release with four high-severity flaws and possible remote code execution should be tracked, with documented priorities and remediation times, starting with internet-facing services.
What to do now
- Take an inventory of your Node.js installations:
node --versionon servers and developer workstations, container base images (for examplenode:22,node:24,node:26), CI pipelines, serverless functions, applications that bundle the runtime. - Update to 22.23.4, 24.22.1 or 26.12.1 (or later), depending on the line in use.
- Rebuild and redeploy container images: an embedded runtime does not update itself. Also check that the tags you use really point to the fixed versions.
- Prioritise exposed services that receive external data, especially those that decompress Brotli content.
- Plan the migration of installations on End-of-Life lines, which no longer receive regular updates.
- Read the official bulletin from Node.js for the mapping between CVEs and components and for any temporary mitigations, before deciding on exceptions or postponements.
How ARXDOME helps
ARX Shield shows open vulnerabilities per machine and per package in the portal, with those already exploited highlighted: it helps find monitored machines with Node.js versions to update. ARX Expose reports, from the outside, known vulnerabilities on public services and the products it recognises.
Last updated:
