Node.js released security updates on October 21 to fix 10 flaws, with the most serious being a remote code execution vulnerability in the Brotli decompression code.
The vulnerability or weakness
The vulnerability is an out-of-bounds write in the Brotli decoder, triggered by malformed compressed input. The flaw is rated high rather than critical.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-10548 | 1.9 | LOW | No | - |
| CVE-2026-106069 | n/a | not scored | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases (2026-10-21)
- Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution (2026-10-20)
Business impact
Organizations using affected Node.js versions risk unauthorized code execution, potentially leading to data breaches or system compromise, impacting operations and reputation.
Industries affected
This issue affects a wide range of industries, including software development, web hosting, and any organization that relies on Node.js for critical applications.
Users affected
Users of Node.js 22.x, 24.x, and 26.x versions are affected and should update to the fixed versions 22.23.4, 24.22.1, and 26.12.1, respectively, to mitigate the risk.
