Node.js Addresses 10 Vulnerabilities Including High-Severity RCE Risk in Brotli Decompression
The Node.js project has released security updates addressing ten vulnerabilities, one of which could allow remote code execution through the processing of Brotli compressed data.
On October 21, 2026, maintainers published details for ten CVEs. Although none reached the Critical severity tier, four issues were rated High. The most serious of these, CVE-2026-111497, resides in the Brotli decompression routine and permits out-of-bounds memory writes that may be leveraged for remote code execution. Affected versions include Node.js 26.x, 24.x, and 22.x.
Two further High-severity flaws, CVE-2026-105483 and CVE-2026-106069, stem from inconsistencies in IP address representation that allow attackers to bypass TLS hostname verification. A related DNS issue tracked as CVE-2026-105482 causes names containing NUL characters to be truncated during resolution.
The remaining six vulnerabilities comprise three Medium-severity and three Low-severity findings. These cover incomplete certificate validation, reuse of random values when using startup snapshots, and bypasses of file-system permission controls.
Corrective releases Node.js 26.12.1, 24.22.1, and 22.23.4 have been published. The updates also incorporate newer versions of the third-party libraries c-ares, OpenSSL, SQLite, and Undici to address known issues in those components.
Developers running end-of-life Node.js versions are urged to migrate to a supported release branch to eliminate exposure to the newly disclosed weaknesses.
Related articles
HPE Discloses 72 Vulnerabilities in AOS-10 and AOS-8 Wireless LAN Operating Systems, 33 Rated Critical
Hewlett Packard Enterprise has published a security advisory detailing 72 vulnerabilities affecting its wireless LAN operating systems AOS-10 and AOS-8. The flaws impact mobility controllers, gateways, access points, and virtual machines running these platforms. Thirty-three of the issues received the highest severity rating of Critical, with eight vulnerabilities scoring the maximum CVSSv3.1 base score of 10.0. Specific examples include a buffer overflow tracked as CVE-2026-79847 in AOS-10, plus command injection and SQL injection flaws in AOS-8 that allow unauthenticated remote code execution. No exploitation of these vulnerabilities has been observed at the time of disclosure. The advisory was released on October 22, 2026, and organizations are urged to apply available patches promptly.
Mitigating PHP2Shell RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Legacy PHP 5.6 Stacks with Varnish, Docker and Apache mod_php
Two critical remote code execution vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) affect PHP before any application code executes, targeting the Zend Engine's longjmp() mechanism during OOM conditions and use-after-free issues with session upload progress. Official patches exist only for supported branches 8.2.35 and newer, leaving PHP 5.6 installations exposed, especially those using Apache with mod_php. An administrator of a high-traffic legacy enterprise application running PHP 5.6 inside Docker containers behind Varnish implemented a four-layer defense without rewriting the monolith. The approach disables session.upload_progress.enabled and sets memory_limit to -1 inside PHP, enforces strict cgroups memory limits and MaxConnectionsPerChild 1 in Apache, adds request-size and cookie-based blocks in Varnish VCL, and forces Connection: close on synthetic error responses. Testing revealed HTTP keep-alive drain issues and differing behavior between direct Apache requests and Varnish-routed traffic. The layered controls successfully neutralize both attack vectors while preserving production stability.
Node.js Fixes High-Severity Brotli Decoder Flaw Leading to Remote Code Execution
A high-severity vulnerability in the bundled Brotli decoder of Node.js allows out-of-bounds writes when processing attacker-controlled compressed data, potentially resulting in remote code execution. The flaw, tracked as CVE-2026-111497, affects all supported branches including 22.x, 24.x, and 26.x prior to the October 21, 2026 security release. Patched versions 22.23.4, 24.22.1, and 26.12.1 address the memory corruption issue that arises during Brotli decompression in services accepting third-party content. The same update resolves additional high-severity problems, notably hostname validation weaknesses in TLS. Organizations using unsupported branches such as 18.x, 20.x, 23.x, and 25.x must migrate to maintained releases, while those linking against system Brotli libraries should verify inclusion of upstream commit 0ed4268. Security teams are advised to audit all environments, including containers and CI pipelines, that process Brotli-encoded data.
Critical GitLab Flaw CVE-2026-110264 Allows Unauthenticated Remote Code Execution
GitLab has released patches for a maximum-severity vulnerability that permits unauthenticated remote code execution on self-managed installations. The flaw, tracked as CVE-2026-110264 with a CVSS score of 10.0, stems from an integer overflow during regular expression compilation. It affects every version starting from 7.0 released in 2014 and impacts both Community and Enterprise editions. The issue was reported through the company's HackerOne bug bounty program and has no available workaround. Patches are available in multiple recent releases, though earlier critical updates from October 12 do not cover this vulnerability. No exploitation has been observed as of October 22, and the flaw is not yet listed in the NVD or CISA's exploited vulnerabilities catalog.