Eight bytes, and a decoder that asked for more
The Node.js project shipped security releases for its 26.x, 24.x and 22.x lines on 21 October, as versions 26.12.1, 24.22.1 and 22.23.4. Ten CVEs are fixed, four of them rated high. End-of-life versions are affected too.
The one with an AI lab’s name on it is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder. Node.js credits OpenAI Codex Security, naming Khai Tran and Sylvie Mayer as reporters, with Matteo Collina and Antoine du Hamel fixing it.
The mechanism is a misclassified error. The decoder treated an invalid block switch as a temporary need for more input rather than a permanent format error. The streaming decoder then kept appending input bytes into an eight-byte internal buffer and wrote past its end. Any application that decompresses attacker-supplied Brotli data through node:zlib can have its process memory corrupted, and Node.js puts the impact at anything from a crash to memory disclosure to remote code execution.
Four fixes for things already fixed
The more uncomfortable detail in this release is how many entries are second attempts. CVE-2026-105482, in which dns.resolve*() and dns.reverse() truncate names containing a NUL byte, is described by the project as an incomplete fix of CVE-2026-48930. CVE-2026-105481, where keep-alive sockets accept a response received before the request was sent, is an incomplete fix of CVE-2026-48931. CVE-2026-106073, in which fs.realpathSync() skips read permission checks under --permission, is an incomplete fix of CVE-2026-21715. CVE-2026-105483 is described as a regression after CVE-2026-48618.
That last one is the clearest: tls.checkServerIdentity() does not recognise fullwidth-digit IP addresses such as １２７.0.0.1, so a certificate carrying only DNS subject alternative names can be matched against one. Two further entries attack the same seam from different directions. CVE-2026-106069 covers leading-zero IPv4 hosts like 0127.0.0.1, which the WHATWG URL parser reads as octal while the operating system resolver on some platforms reads as decimal, so a certificate is validated against a different address than the one connected to. CVE-2026-106072 extends that to other non-canonical spellings — 0177.0.0.1, 0x7f.0.0.1, 2130706433, 127.1.
The one that repeats itself
CVE-2026-106074 is rated medium and is the strangest of the set. The caches behind crypto.randomUUID(), randomUUIDv7() and randomInt() are saved into startup snapshots and single-executable applications. Every process started from such a snapshot then repeats the same values. Anything that treated a generated identifier as unguessable — a session token, a password-reset link, an idempotency key — would be reusing a sequence an attacker could observe once and predict thereafter.
Two low-severity entries affect 26.x only: zlib.ZipFile returning attacker-controlled bytes after a failed header validation, so a scanner can approve different content than other ZIP tools extract, and a wildcard --allow-fs-read/--allow-fs-write rule matching shorter paths, where /etc/passwd.* also grants /etc/passwd.
What to watch
The release also updates bundled dependencies: c-ares, OpenSSL, SQLite and Undici across the affected lines, plus a certificate-authority bundle update tied to the compromise of an eMudhra intermediate CA. That last item is a separate trust problem travelling inside a routine patch, and operators who track only CVE identifiers will not see it.
The pattern worth following is the repeat-fix rate. Four incomplete fixes and a regression in one release points at a class of bugs — IP address parsing, in particular — where each patch keeps leaving an adjacent spelling unhandled, and where the next finding is likely to look much like the last.
