#tlssecurity

Read Time:3 Minute, 26 Second

The Node.js project has released security updates for its supported 26.x, 24.x and 22.x branches, addressing ten vulnerabilities across compression, TLS verification, DNS handling, HTTP connections, cryptographic randomness and filesystem permissions. Four issues are rated high severity, with a Brotli decoder memory corruption bug carrying the most serious potential outcome: remote code execution.

The patched releases are Node.js 26.12.1, 24.22.1 and 22.23.4. Operators should install the appropriate version for their branch, rebuild containers and serverless bundles that embed the runtime, and restart long-running services. Merely updating a development workstation will not replace Node.js copies already shipped in production images.

Brotli decoder bug can cross a trust boundaryCVE-2026-111497 is an out-of-bounds write in the Brotli decoder affecting all three supported release lines. Writing beyond an allocated memory region can crash a process and, under suitable conditions, enable attacker-controlled code execution. Applications that automatically decompress untrusted Brotli content should be prioritized because remote input may reach the affected component.

The available advisory information does not fully describe the exploitation requirements. That uncertainty should not be interpreted as evidence of low risk. Internet-facing gateways, content-processing services and applications that accept compressed uploads have a clearer exposure path than systems that never handle attacker-controlled compressed data.

TLS and DNS inconsistencies weaken destination checksTwo high-severity vulnerabilities affect certificate hostname verification. CVE-2026-105483 concerns IP addresses written with full-width digits and affects the 26.x and 24.x branches. CVE-2026-106069 applies when a hostname loosely resolves to an IP address and affects 26.x, 24.x and 22.x. Both can cause an application to accept a certificate that should not match the intended endpoint.

These flaws are especially relevant to services that make outbound HTTPS requests based on user-controlled or tenant-provided destinations. Certificate validation is a core boundary against interception and redirection; unusual hostname representations should not produce a different security decision from their conventional form.

The fourth high-severity issue, CVE-2026-105482, causes dns.resolve to truncate names containing a NUL character. Security checks that inspect one string while the resolver uses a shortened version can create validation gaps. The bug affects all three supported branches.

Other fixes cover HTTP, randomness and permissionsCVE-2026-105481 addresses a keep-alive connection that can process a response written before its corresponding request was sent. CVE-2026-106072 corrects certificate validation for nonstandard IPv4 hostnames. Both are rated medium and apply to the supported branches.

Another medium-severity issue, CVE-2026-106074, can cause processes created from startup snapshots or single executable applications to repeat values returned by crypto.randomUUID() and crypto.randomInt(). Applications must not assume identifiers are unpredictable when runtime state has been cloned incorrectly.

Low-severity fixes address untrusted bytes exposed after failed ZIP header validation, wildcard behavior that grants excess filesystem access, and a Permission Model bypass through fs.realpathSync. The release also refreshes bundled components such as c-ares, CA certificates, Undici, OpenSSL and SQLite, depending on the branch.

What engineering teams should do nowInventory the exact Node.js runtime in hosts, containers, build images and serverless packages.

Upgrade to 26.12.1, 24.22.1 or 22.23.4 and replace immutable artifacts.

Test outbound HTTPS, DNS resolution and Brotli content handling after the update.

Review applications that use startup snapshots or single executables for security-sensitive random values.

Migrate any end-of-life Node.js branch to a supported release line.

Teams should also verify the runtime from inside the deployed artifact rather than trusting a manifest or base-image tag. Moving tags can leave cached layers in place, and package-lock updates do not necessarily upgrade the Node.js executable.

The breadth of this release makes it relevant even to applications that do not use Brotli directly. TLS and DNS behavior sits underneath common HTTP libraries, while embedded runtime copies can be easy to miss. A complete response combines patching with an inventory of where Node.js actually executes across the delivery pipeline.

Read Time:3 Minute, 12 Second

Browser makers and software maintainers are rapidly withdrawing trust from eight eMudhra intermediate certificate-authority certificates after a researcher demonstrated control of their private signing keys. Because the intermediates connect to roots accepted by major platforms, clients that still trust the affected chains could potentially accept fraudulent certificates as genuine.

The researcher, identified publicly as Wayne, reported the issue to certificate root programs on October 17, 2026. To prove possession without publishing the secrets themselves, the researcher signed a short message with each compromised private key. The corresponding certificates, public keys and signatures were released so independent reviewers could verify the result with standard cryptographic tools.

Why an intermediate CA key mattersA website certificate is usually trusted through a chain: the site certificate is signed by an intermediate authority, which ultimately links to a root embedded in a browser, operating system or application. Possession of an intermediate’s private key may allow an attacker to issue new certificates that vulnerable clients accept under that chain.

That capability does not automatically place an attacker inside a user’s network. But when combined with the ability to intercept or redirect traffic, a forged certificate could support convincing website impersonation and potentially allow encrypted traffic to be read or modified. This is why certificate-authority incidents demand ecosystem-wide action rather than a fix on a single web server.

The public evidence confirms signing capability, not the cause of the exposure. It does not establish that the keys were recovered through a rapid cryptographic break, despite claims circulating online, and it does not prove that forged certificates were used against end users. How the keys became accessible remains publicly unresolved.

Browsers moved quickly to block the chainsMozilla received the report at 20:06 UTC on October 17 and completed a OneCRL blocklist rollout less than three hours later. Standard Firefox configurations could receive that protection without a conventional browser upgrade or restart. Chrome reportedly blocked the certificates the same day, Apple followed on October 19, and Microsoft deployed protection on October 20. eMudhra has revoked the affected intermediates as well.

Mozilla also shipped Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1 for environments where settings might prevent OneCRL delivery. NSS 3.131.1 removes the associated signing root from the trust list used by other software. Additional fixed trust bundles include Go 1.27.3 and 1.26.10, Python certifi 2026.10.19, and Rust webpki-roots 1.0.10. Updates for some other ecosystems were still pending when the incident response information was reviewed.

Application trust stores are the long tailCertificate revocation alone is not universal protection. Some programs do not check revocation status reliably, cannot receive browser-maintained blocklists, or ship a private copy of trusted roots. A fully updated browser may reject the affected chain while a command-line client, container image, embedded device or older application continues to accept it.

Update browsers and operating systems across managed endpoints.

Inventory runtimes, containers and applications that bundle their own CA files.

Upgrade language-specific trust packages and rebuild images that pin older bundles.

Use the public incident test chains to check important clients for rejection.

Escalate any unexpected acceptance or suspicious certificate observations to the security team.

Manual removal of roots should be reserved for experienced administrators because trust-store changes can break legitimate connections. Where vendors have published supported releases, those updates provide a safer and more auditable remedy.

The incident illustrates a recurring weakness in public-key infrastructure: emergency browser controls can protect mainstream users quickly, while fragmented software dependencies take longer to converge. Organizations need an inventory of certificate bundles just as they need an inventory of vulnerable libraries. Without it, defenders may patch the visible browser fleet and overlook the services that perform sensitive machine-to-machine connections.