Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Node.js Releases Security Updates Addressing Multiple Vulnerabilities

Four high severity vulnerabilities identified, including CVE-2026-111497, an out-of-bounds write vulnerability that could allow remote code execution

Threat ID:
CC-4881
Threat Severity:
Medium
Published:
23 October 2026 2:28 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Four high severity vulnerabilities identified, including CVE-2026-111497, an out-of-bounds write vulnerability that could allow remote code execution

Threat details

Introduction

Node.js has released security updates to address ten vulnerabilities affecting Node.js. Of particular concern is CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder that could allow remote code execution (RCE).

Vulnerability Details

  • CVE-2026-105482 – 'dns.resolve truncates names containing NUL char' vulnerability – High severity
  • CVE-2026-105483 – 'TLS certificate hostname bypass when the IP is written fullwidth digits' vulnerability – High severity
  • CVE-2026-106069 – 'TLS certificate hostname bypass when the host loosely resolves to an IP address' vulnerability – High severity
  • CVE-2026-111497 – 'Out-of-bounds Write' vulnerability – CVSS v4.0 score: 9.2
  • CVE-2026-105481 – 'Keep-alive socket processes a response that was written before the request was sent' vulnerability – High severity
  • CVE-2026-106072 – 'Improper certificate validation for non-canonical IPv4 hostnames' vulnerability – Medium severity
  • CVE-2026-106074 – 'crypto.randomUUID() and randomInt() entropy caches saved into user-land startup snapshots and SEAs' vulnerability – Medium severity
  • CVE-2026-106070 – 'ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation' vulnerability – Low severity
  • CVE-2026-106071 – 'Permission Model filesystem over-grant via wildcard radix lookup' vulnerability – Low severity
  • CVE-2026-106073 – 'Permission Model bypass with fs.realpathSync' vulnerability – Low severity

Proof-of-Concept Released for CVE-2026-111497

A public proof-of-concept (PoC) has been released for CVE-2026-111497. The NHS England National CSOC assesses future exploitation as likely.

Remediation advice

Affected organisations are encouraged to review the Node.js October 2026 Security Release and apply the relevant updates as soon as possible.

Last edited: 23 October 2026 2:28 pm