GoPlus flags Node.js October patch for 10 flaws, including RCE-risk Brotli bug

Node.js patched 10 vulnerabilities on Oct 21, 2026: four high-, three medium-, and three low-severity. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that can enable remote code execution with untrusted compressed data. Other high-severity flaws include a dns.resolve NUL-truncation issue and two TLS hostname-verification bypasses. Patched releases are 22.23.4, 24.22.1, and 26.12.1. GoPlus advises inventorying actual running versions, prioritizing exposed services, and restricting untrusted inputs if upgrades are delayed.

✨ AI summary of the linked source — not editorial content.