Node.js Vulnerability: Brotli RCE Fixed on 21 October 2026
No7 Engineering Team
Growth Architecture Unit
A Node.js security release is an update that fixes vulnerabilities in the Node.js runtime itself. On 21 October 2026 the Node.js project shipped one for the 26.x, 24.x and 22.x lines: the advisory lists ten vulnerabilities, four of them rated high, fixed across Node.js 26.12.1, 24.22.1 and 22.23.4. Which fixes each line receives varies. The most serious Node.js vulnerability, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that can permit remote code execution. If you run a headless storefront, a Shopify app backend or any Node.js service, update today.
Node.js CVEs fixed in the October 2026 security release
The Node.js project lists four high, three medium and three low severity issues. The high and medium issues, as named in the security release announcement:
| Issue | CVE | Severity |
|---|---|---|
| Brotli decoder out-of-bounds write permits remote code execution | CVE-2026-111497 | High |
| TLS certificate hostname bypass when the IP is written in fullwidth digits | CVE-2026-105483 | High |
| TLS certificate hostname bypass when the host loosely resolves to an IP address | CVE-2026-106069 | High |
| dns.resolve truncates names containing a NUL character | CVE-2026-105482 | High |
| Keep-alive socket processes a response written before the request was sent | CVE-2026-105481 | Medium |
| Certificate validation for non-canonical IPv4 hostnames lets DNS SANs authenticate IP endpoints | CVE-2026-106072 | Medium |
| crypto.randomUUID() and randomInt() entropy caches saved into startup snapshots and single executable apps | CVE-2026-106074 | Medium |
The three low-severity issues cover the ZipFile API and two Permission Model bypasses; the table below shows which releases include them. The release also updates bundled dependencies: c-ares and Undici on all three lines, the CA certificate store on all three lines after an eMudhra intermediate CA compromise, OpenSSL on 24.x and 22.x, and SQLite on 22.x. The Node.js project also notes that end-of-life versions are always affected when a security release occurs.
Which Node.js versions fix the vulnerabilities?
The fixed versions are Node.js 26.12.1, 24.22.1 and 22.23.4. The release notes show which fixes each line received:
| Fix | 26.12.1 | 24.22.1 | 22.23.4 |
|---|---|---|---|
| Brotli RCE (CVE-2026-111497, high) | Yes | Yes | Yes |
| TLS hostname bypass, host loosely resolves to an IP (CVE-2026-106069, high) | Yes | Yes | Yes |
| TLS hostname bypass, fullwidth-digit IP (CVE-2026-105483, high) | Yes | Yes | Not affected |
| dns.resolve NUL bytes (CVE-2026-105482, high) | Yes | Yes | Yes |
| Non-canonical IPv4 certificate validation (CVE-2026-106072, medium) | Yes | Yes | Yes |
| HTTP agent keep-alive (CVE-2026-105481, medium) | Yes | Yes | Yes |
| crypto random caches in user-land snapshots (CVE-2026-106074, medium) | Yes | Yes | Yes |
| ZipFile prefix bytes (CVE-2026-106070, low) | Yes | Not affected | Not affected |
| Permission Model, fs.realpathSync (CVE-2026-106073, low) | Yes | Yes | Yes |
| Permission Model, wildcard radix lookup (CVE-2026-106071, low) | Not in release notes | Not affected | Not affected |
Why the Brotli fix matters for web apps
Brotli is the br content encoding many servers and CDNs use. Node.js exposes it through the zlib module, with zlib.createBrotliDecompress() and zlib.brotliDecompress(), and the zlib documentation shows the typical pattern of decompressing a response whose content-encoding is br. The fix itself is a patch to the bundled Brotli dependency. Any service that decompresses Brotli data it does not fully control, such as responses from third-party APIs or uploaded files, is where the bug matters most, so update instead of trying to filter inputs.
The TLS issues are about certificate hostname checks for IP addresses, and the medium crypto issue matters if you build startup snapshots or single executable apps: values from crypto.randomUUID() and randomInt() could repeat across processes, which is a problem for anything that relies on them being unique.
"Not affected" means the advisory lists the issue for other lines only. The advisory says CVE-2026-106071 affects 26.x, but the 26.12.1 release notes do not list a fix for it.
Does the Node.js vulnerability affect Vercel, Netlify and Shopify apps?
It depends on who installs the Node.js binary. The platforms below handle it differently:
- Vercel. You choose only the major version (24.x or 22.x). Vercel's documentation says it rolls out minor and patch updates automatically when needed, such as to fix a security issue. Check that the major line is one with a fix, and move off anything older.
- Netlify. Netlify pins each site to a Node.js version for builds. A
NODE_VERSION,.node-versionor.nvmrcvalue set to a major such as24gets the latest 24.x release on the next build; an exact version stays where it is until you change it. Functions use the build's Node.js version unlessAWS_LAMBDA_JS_RUNTIMEoverrides it. Redeploy and check the version in the build log. - Shopify apps. Shopify's recommended app template is a React Router app with server-side logic. If you host it yourself on Node.js, the update is yours, like any other Node.js service.
- Hydrogen on Oxygen. Oxygen runs the storefront as a Web Worker on Cloudflare's workerd runtime, using web-standard APIs instead of Node APIs. The Node.js you use to build and develop the storefront still needs the update.
- Railway. Railway paused deployments after its own security breach, and builds are coming back plan by plan. Rotate the secrets first, then ship the Node.js update once you can deploy.
Which Node.js LTS version should you run?
The Node.js project says production applications should only use Active LTS or Maintenance LTS releases. According to the Node.js release schedule:
| Line | Status on 22 October 2026 | End of life | Fixed release |
|---|---|---|---|
| Node.js 26 | Current; becomes LTS on 28 October 2026 | 30 April 2029 | 26.12.1 |
| Node.js 24 (Krypton) | Maintenance LTS since 20 October 2026 | 30 April 2028 | 24.22.1 |
| Node.js 22 (Jod) | Maintenance LTS | 30 April 2027 | 22.23.4 |
| Node.js 20 (Iron) | End of life since 30 April 2026 | 30 April 2026 | None |
For most production storefronts and app backends, Node.js 24 is the right call today, with a move to 26 once it becomes LTS and your dependencies support it. Node.js 22 is fine for now but reaches end of life in April 2027. Node.js 20 gets no fix at all; see the previous releases page for every line's status.
How to update Node.js to the patched version
- Check the current version. Run
node -von every server, container and CI runner. Build images and serverless runtimes count too. - Pick the fixed release for your line. Move to 26.12.1, 24.22.1 or 22.23.4. Staying on the same major line keeps you on the same APIs, so it is the smallest change you can make.
- Update the way you installed Node.js. With a version manager such as nvm, install the new patch version and set it as default. With Docker, change the image tag to the patched version, rebuild and redeploy every container. With a hosting platform, set the Node.js version in its settings or in the engines field your platform reads, then redeploy.
- Restart long-running processes. A running process keeps the old binary until it restarts, so restart PM2, systemd services and workers after the update.
- Verify and test. Confirm
node -von the live service, run your test suite, and check checkout, webhooks and any API integrations.
If you are on Node.js 20 or older, the update is a major version move. Test it on staging first. Headless Shopify storefronts and custom apps built on Node.js are covered by our headless Shopify development and Shopify app development teams.
What to do next
List every Node.js runtime you run, including CI and build images, and update each to 26.12.1, 24.22.1 or 22.23.4 today. Plan the move off Node.js 20 or older now, and off 22 before April 2027. If PHP also runs somewhere in your stack, the PHP2Shell vulnerabilities fixed the same day need the same treatment. Services hosted on Railway also need their secrets rotated after the Railway security breach.
Frequently Asked Questions
The questions buyers and engineers ask us most about this topic.
Which Node.js versions fix the October 2026 vulnerabilities?
Node.js 26.12.1, 24.22.1 and 22.23.4, released on 21 October 2026. The advisory lists ten issues, four rated high; every line gets the Brotli decoder remote code execution fix for CVE-2026-111497, while some lower-severity fixes differ by line.
How do I update Node.js to the patched version?
Check node -v, install the fixed release for your line with your version manager, Docker image tag or hosting setting, redeploy, and restart long-running processes such as PM2 or systemd services. Then confirm node -v on the live service.
Is Node.js 20 still supported?
No. Node.js 20 reached end of life on 30 April 2026, so it gets no security fixes. The Node.js project says production should use Active LTS or Maintenance LTS releases, which today means 24 or 22, with 26 becoming LTS on 28 October 2026.
Does the Node.js vulnerability affect Vercel?
Vercel lets you choose only the major Node.js version and says it rolls out minor and patch updates automatically when needed, such as to fix a security issue. Make sure the project runs 24.x or 22.x.
Does the Node.js vulnerability affect Shopify Hydrogen on Oxygen?
Oxygen runs Hydrogen storefronts as Web Workers on Cloudflare's workerd runtime, using web-standard APIs instead of Node APIs. The Node.js you use to build and develop the storefront, and any self-hosted Shopify app backend, still needs the update.