Node.js Releases security updates fixing high-severity vulnerabilities across three version branches
BIBIBI
AT A GLANCE
Node.js Three version branches have been reported to contain multiple vulnerabilities; users should update to the corresponding fixed versions or the latest supported version.
Article
More than PHP，Node.js Three version branches are also affected by high-severity vulnerabilities; users should promptly update their runtime environments.
According to BlockBeats,October 22，Node.js project on October 21 released security updates involving 26.x、24.x and 22.x version branches, with fixed versions 26.12.1、24.22.1 and 22.23.4, respectively. This announcement lists 10 vulnerabilities in total, including 4 high-severity, 3 medium-severity, and 3 low-severity vulnerabilities; the scope of impact varies across version branches.
Among them, the high-severity vulnerability CVE-2026-111497 involves an out-of-bounds write in the Brotli decoder, which could result in remote code execution and affects the above three version branches. Other high-severity issues include null-character handling in DNS parsing, as well as TLS certificate hostname verification bypass.
This update also fixes issues with persistent connection response handling, duplicate random-number caching, and the permission model, and updates dependency components such as c-ares, OpenSSL, and Undici. The official notice cautions that end-of-life versions may also be affected by security vulnerabilities, and users should use the latest supported version.
Previously reported,PHP fixed critical vulnerabilities that could lead to unauthenticated remote code execution, with fixed versions 8.5.12、8.4.27、8.3.36 and 8.2.35. The official notice urged users to upgrade immediately.
Original link https://m.theblockbeats.info/flash/373052
Key points
01
According to BlockBeats,Node.js the project on October 21 released security updates involving 26.x、24.x and 22.x version branches.
02
The corresponding fixed versions are 26.12.1、24.22.1 and 22.23.4。
03
The announcement lists 10 vulnerabilities, including 4 high-severity, 3 medium-severity, and 3 low-severity vulnerabilities.
04
The high-severity vulnerability CVE-2026-111497 involves an out-of-bounds write in the Brotli decoder, which could result in remote code execution and affects the above three version branches.
05
Other high-severity issues include DNS null-character handling in parsing, as well as TLS certificate hostname verification bypass.
06
The update also fixes issues with persistent connection response handling, duplicate random-number caching, and the permission model, and updates dependency components such as c-ares, OpenSSL, and Undici.
07
The official notice cautions that end-of-life versions may also be affected by security vulnerabilities, and users should use the latest supported version.
08
Previously reported,PHP fixed critical vulnerabilities that could lead to unauthenticated remote code execution, with fixed versions 8.5.12、8.4.27、8.3.36 and 8.2.35。
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This means that some Node.js runtime environments have serious security issues, one of which could allow an attacker to execute code remotely. Users of the relevant version branches should verify their current versions and upgrade to the fixed versions listed in the article or the latest supported version.
Why it matters to readers
If servers, exchanges, wallets, or other services use affected Node.js versions, the vulnerabilities may threaten the runtime environment and the data it processes. Prompt upgrades provide the fixes mentioned in the announcement.
Beginners who run Node.js applications themselves should first check the Node.js version; if using a hosted service, they can monitor whether the service provider has completed the update. Do not treat the PHP vulnerability and the Node.js vulnerability as the same incident.
Risks and unknowns
No evidence is attached Node.js The official security advisory link is not provided; specific details still need to be verified against official sources.
The specific scope of impact for each version branch is not fully listed in the evidence.
The evidence does not indicate whether these vulnerabilities have been actively exploited.
The evidence does not indicate whether the upgrade has compatibility implications.
Related Developments
Loading event timeline…
Related concepts
Remote code execution
This term is not in the glossary yet. Browse related concepts in the glossary.
