Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Node.js Releases Security Updates Addressing Multiple Vulnerabilities

Four high severity vulnerabilities identified, including CVE-2026-111497, an out-of-bounds write vulnerability that could allow remote code execution

Threat ID:
CC-4881
Threat Severity:
Medium
Published:
23 October 2026 2:28 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Four high severity vulnerabilities identified, including CVE-2026-111497, an out-of-bounds write vulnerability that could allow remote code execution

Threat details

Active Exploitation of CVE-2026-111497

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-111497 vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.

Security researchers have reported successful code execution against Node.js 24.22.0, requiring multiple attempts, alongside reports of active exploitation attempts. 

The NHS England National CSOC assesses further exploitation as highly likely.

Introduction

Node.js has released security updates to address ten vulnerabilities affecting Node.js. Of particular concern is CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder that could allow remote code execution (RCE).

Vulnerability Details

  • CVE-2026-105482 – 'dns.resolve truncates names containing NUL char' vulnerability – High severity
  • CVE-2026-105483 – 'TLS certificate hostname bypass when the IP is written fullwidth digits' vulnerability – High severity
  • CVE-2026-106069 – 'TLS certificate hostname bypass when the host loosely resolves to an IP address' vulnerability – High severity
  • CVE-2026-111497 – 'Out-of-bounds Write' vulnerability – CVSS v4.0 score: 9.2
  • CVE-2026-105481 – 'Keep-alive socket processes a response that was written before the request was sent' vulnerability – High severity
  • CVE-2026-106072 – 'Improper certificate validation for non-canonical IPv4 hostnames' vulnerability – Medium severity
  • CVE-2026-106074 – 'crypto.randomUUID() and randomInt() entropy caches saved into user-land startup snapshots and SEAs' vulnerability – Medium severity
  • CVE-2026-106070 – 'ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation' vulnerability – Low severity
  • CVE-2026-106071 – 'Permission Model filesystem over-grant via wildcard radix lookup' vulnerability – Low severity
  • CVE-2026-106073 – 'Permission Model bypass with fs.realpathSync' vulnerability – Low severity

Threat updates

Date Update
29 Oct 2026 Active Exploitation of CVE-2026-111497

Updated red box to reflect exploitation of CVE-2026-111497

Remediation advice

Affected organisations are encouraged to review the Node.js October 2026 Security Release and apply the relevant updates as soon as possible.

Last edited: 29 October 2026 12:50 pm