Node.js October security releases

10 CVEs fixed October 21, 2026 — 4 high, 3 medium, 3 low — across all supported lines. Headline flaw: Brotli decoder out-of-bounds write, CVE-2026-111497, demonstrated as code execution ("Node2Shell," Imperva, Oct 23). Node.js rates it High; the CVE record (Google as CNA) scores it CVSS 4.0 9.2 Critical; Tenable and Singapore's CSA list 9.8 under v3.1.

Verdict: patch this cycle, not an incident. No in-the-wild exploitation reported and no published attack behaviors to hunt — this is a patch-inventory problem, including every container image and single-executable binary that bundles its own copy of Node. Node.js published no workarounds for any of the ten flaws. Escalate to incident handling only on the triggers below.

30-second read

Feeding crafted Brotli-compressed data to Node's bundled decoder corrupts memory. Imperva reported attacker-supplied code execution on an official Node 24.22.0 Linux arm64 build; the circulating public PoC reaches full code execution only on a deliberately weakened build — on standard builds it crashes the process and leaks a limited slice of memory. The reachable paths are Node's built-in fetch() decoding a Brotli response from a server the attacker controls, and Express 5 body parsers decoding Brotli request bodies. The same release also fixes TLS certificate-check bypasses via unusual IP-address formats and a startup-snapshot flaw that makes randomUUID()/randomInt() repeat values in snapshot/SEA builds.

Fixed versions — October 21, 2026

The ten, briefly

Detection coverage — as of Oct 23

Applies across every scanner above: this is a runtime flaw — SCA/dependency scanners will not surface it, and host scans see installed Node, not copies baked into container images or SEA binaries.

Inferred detections — while you wait

No vendor-published queries exist for this flaw. The logic below is inferred from the exploit shape (crafted Brotli → memory corruption → crash or code execution), not published by anyone — tune to your environment and expect noise. Failed exploitation is loud; success may be quiet.

Node crash canary — on standard builds the public PoC crashes the process, so a burst of Node crashes is the cheapest tripwire:

# EDR / syslog / crash telemetry
process.name = node (or your bundled runtime names)
termination.signal IN (SIGSEGV, SIGABRT, SIGBUS)
→ alert when count per host > baseline over 1h; triage what it was fetching

Node spawning shells — generic post-exploitation shape for any runtime RCE:

# EDR process lineage
parent.name IN (node, nodejs)
child.name IN (sh, bash, dash, curl, wget, python*, perl)
exclude: build/CI hosts where this is routine

Response-side exposure — the riskier path is your servers fetching Brotli from outside; proxy logs can show which services actually do:

# egress proxy / NetFlow with HTTP metadata
src IN (server subnets) AND response.content_encoding = br
AND dest.domain not seen before (e.g. first_seen < 7d)
→ inventory which apps decode untrusted Brotli at all; those patch first

Splunk (index=*) / Elastic ES|QL (FROM logs-*) — CIM Endpoint / Web field names for Splunk, ECS for Elastic, Sysmon names for lineage; tune to your add-on or integration:

# node crash canary: more than a baseline of crashes per host per hour
index=* earliest=-30d@d (process_name="node" OR Image="*/node" OR "node[") (signal IN ("SIGSEGV","SIGABRT","SIGBUS") OR "SIGSEGV" OR "SIGABRT" OR "SIGBUS")
| bin _time span=1h
| stats count by _time host
| where count>3

# node spawning shells (exclude build/CI hosts where this is routine)

index=* earliest=-30d@d ParentImage IN ("*/node","*/nodejs") Image IN ("*/sh","*/bash","*/dash","*/curl","*/wget","*/python*","*/perl")
| where NOT cidrmatch("<build/CI subnets>", src_ip)
| stats count values(CommandLine) as cmds by host ParentImage Image

# response-side exposure: servers fetching Brotli from new destinations

index=* earliest=-7d@d (response_content_encoding="br" OR "content-encoding: br")
| where cidrmatch("<server subnets>", src)
| stats min(_time) as first_seen count by src dest
| where first_seen > relative_time(now(), "-7d@d")

# version inventory (software-inventory or process events carrying a version string)

index=* earliest=-7d@d (process_name="node" OR "node.exe") version=*
| eval fixed=case(match(version,"^26\."), "26.12.1", match(version,"^24\."), "24.22.1", match(version,"^22\."), "22.23.4", true(), "EOL line")
| stats dc(host) as hosts values(host) as sample by version fixed

// node crash canary: more than a baseline of crashes per host per hour
FROM logs-*
| WHERE @timestamp > NOW() - 30 days
| WHERE (process.name == "node" OR process.executable LIKE "*/node" OR message LIKE "*node[*")
    AND (message LIKE "*SIGSEGV*" OR message LIKE "*SIGABRT*" OR message LIKE "*SIGBUS*")
| STATS count = COUNT(*) BY t = BUCKET(@timestamp, 1 hour), host.name
| WHERE count > 3

// node spawning shells (exclude build/CI hosts where this is routine)

FROM logs-*
| WHERE @timestamp > NOW() - 30 days
| WHERE process.parent.name IN ("node", "nodejs")
    AND (process.name IN ("sh", "bash", "dash", "curl", "wget", "perl") OR process.name LIKE "python*")
| WHERE NOT CIDR_MATCH(host.ip, "<build/CI subnets>")
| STATS count = COUNT(*), cmds = VALUES(process.command_line) BY host.name, process.parent.name, process.name

// response-side exposure: servers fetching Brotli from new destinations

FROM logs-*
| WHERE @timestamp > NOW() - 7 days AND message LIKE "*content-encoding: br*"
| WHERE CIDR_MATCH(source.ip, "<server subnets>")
| STATS first_seen = MIN(@timestamp), count = COUNT(*) BY source.ip, destination.ip
| WHERE first_seen > DATE_TRUNC(1 day, NOW() - 7 days)

// version inventory (software-inventory or process events carrying a version string)

FROM logs-*
| WHERE @timestamp > NOW() - 7 days
| WHERE process.name IN ("node", "node.exe") AND package.version IS NOT NULL
| EVAL fixed = CASE(STARTS_WITH(package.version, "26."), "26.12.1", STARTS_WITH(package.version, "24."), "24.22.1", STARTS_WITH(package.version, "22."), "22.23.4", "EOL line")
| STATS hosts = COUNT_DISTINCT(host.name), sample = VALUES(host.name) BY package.version, fixed

Timeline

• Oct 21Node.js ships security releases fixing 10 CVEs; no workarounds published
• Oct 22Public reporting on the release and the Brotli flaw
• Oct 23Imperva publishes "Node2Shell": code execution demonstrated on official Node 24.22.0 Linux arm64; fixed 24.22.1 rejects the same input. Qualys ships QID 389117. No in-the-wild exploitation reported; not in CISA KEV

Sources

Node.js October 21 security releases (official) · Tenable CVE record · The Hacker News, Oct 22 · The Hacker News — Node2Shell, Oct 23 · SecurityOnline · Qualys — QID 389117, Oct 23