Node.js Issues Security Releases for 26.x, 24.x and 22.x Fixing High-Severity TLS and Brotli Flaws

Node.js published security updates on October 21, 2026 for the 26.x, 24.x and 22.x release lines. The patches address multiple high-severity vulnerabilities affecting TLS hostname validation and the Brotli decoder, along with updates to critical dependencies including OpenSSL and Undici. Several CVEs cover bypasses in certificate hostname checks when IP addresses use full-width digits or when hosts resolve loosely to IP addresses. A particularly serious out-of-bounds write in the Brotli decoder (CVE-2026-111497) could enable remote code execution on services processing compressed responses. Additional fixes resolve keep-alive socket timing issues, DNS resolution truncation with NUL characters, and entropy caching problems in crypto.randomUUID and randomInt functions. The releases also update c-ares, Undici, OpenSSL, SQLite and ca-cert bundles following the eMudhra intermediate CA compromise.

HispasecOctober 23, 2026Translated from Spanish

Read at source

Node.js released security updates on 21 October 2026 for the 26.x, 24.x and 22.x branches. The fixes address high-severity vulnerabilities in TLS hostname validation and the Brotli decoder while also updating key dependencies such as OpenSSL and Undici.

The most critical changes involve several bypasses in TLS certificate hostname verification. In 26.x and 24.x, verification can fail when an IP address is represented with full-width digits (CVE-2026-105483). A related bypass present in all three branches occurs when a host resolves loosely to an IP address (CVE-2026-106069). Another medium-severity issue allows authentication of non-canonical IPv4 hostnames against DNS SANs (CVE-2026-106072).

A high-impact flaw in the Brotli decoder permits an out-of-bounds write that could lead to remote code execution (CVE-2026-111497). Services exposed to the internet or that accept compressed responses should be prioritised for patching.

Additional network-related fixes include CVE-2026-105481, which corrects a keep-alive socket behaviour allowing responses to be processed before the corresponding request is sent, and CVE-2026-105482, which addresses truncation of names containing NUL characters in dns.resolve.

Further changes cover entropy caching in crypto.randomUUID() and randomInt() that could cause repeated values across processes after snapshot or SEA reuse (CVE-2026-106074). Low-severity fixes in 26.x address ZipFile (CVE-2026-106070) and excessive permission grants via radix wildcard lookups in the filesystem permission model (CVE-2026-106071). All three branches resolve a fs.realpathSync permission model bypass (CVE-2026-106073).

Dependency updates mitigate known issues in c-ares, Undici, OpenSSL, SQLite and the ca-cert bundle following the compromise of an eMudhra intermediate CA. Administrators are advised to update immediately, beginning with perimeter services, and to review container images and non-standard TLS or DNS configurations.

OpenSSL eMudhra CVE-2026-111497 CVE-2026-105483 Undici CVE-2026-106073

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

Telegram for Android Patches Voice Call Vulnerability Enabling Code Execution

Security researchers at NebuSec disclosed a vulnerability in Telegram for Android that allowed remote code execution after a victim answered a voice call. The flaw affected versions from 8.6.2 through 12.10.3 and was fixed in release 12.10.4 at the end of September. The issue stemmed from improper handling of MediaState service messages that carry microphone, camera, and video rotation data during calls. When a required field was missing, the application accessed invalid memory. NebuSec discovered the bug using its Code Security product running on a GPT-5.4 model and confirmed exploitation on ARM64 Android devices for personal calls. A demonstration showed the string “HACKED BY NEBUSEC” appearing roughly 30 seconds after the call was accepted. The vulnerability is unrelated to the earlier animated-sticker attack vector.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Yandex Patches Millions of Stations After eMudhra Certificate Keys Compromised

Yandex has automatically deployed security updates to millions of its smart speakers and partner televisions running YaOS between October 21 and 23. The patches address compromised intermediate certificates issued by eMudhra whose private keys consisted of trivial values from 1 to 255. Attackers who obtained these keys could generate fraudulent certificates and perform man-in-the-middle attacks against device HTTPS traffic. Enthusiasts demonstrated that local network control combined with the certificates allowed replacement of server configuration, activation of ADB, and acquisition of root access on the devices. The update removes trust in the affected certificates, overwrites compromised system files, and disables the debug interface. A factory reset restores the vulnerable firmware, so Yandex advises against resets without a compelling reason.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild

Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.

Security NEXTOct 29, 2026Translated from Japanese