From TokenPost · · 40s
Node.js Security Updates Fix Critical Flaws
Node.js releases security patches for 22.x, 24.x and 26.x branches to address high-severity vulnerabilities.
In brief
Node.js releases security patches for 22.x, 24.x and 26.x branches to address high-severity vulnerabilities. Crypto platforms using Node.js should update to the latest supported version to fix remote code execution risks. Originally reported by TokenPost.
Security Releases Issued
Node.js issued security updates for 22.x, 24.x and 26.x branches on Oct. 21 to fix 10 vulnerabilities.
“A copper repair plate bridges a split clear decompression chamber”
Critical Flaw Details
The high-severity flaw in Brotli decompression allows remote code execution across all three branches.
“Tracked as CVE-2026-111497, the flaw is in Brotli decompression and involves an out-of-bounds write”
Affected Versions
Updates include Node.js 26.12.1, 24.22.1 and 22.23.4 to address null-byte handling and TLS certificate weaknesses.
“The fixes are included in Node.js 26.12.1, 24.22.1 and 22.23.4, respectively”
The short version
Crypto platforms using Node.js should update to the latest supported version to fix remote code execution risks.
