Security Advisory – Node.js Critical Security Patch: Addressing Node2Shell and eMudhra CA Compromise

Date: November 2, 2026

Affected Versions and Technologies:

• Node.js: Vulnerable versions across the 22.x, 24.x, and 26.x release lines, as well as affected end-of-life releases.
• TLS/SSL and X.509: Certificate validation, hostname verification, and certificate-chain trust mechanisms.
• DNS and c-ares: Node.js DNS APIs and the underlying c-ares library.
• Brotli (node:zlib): Brotli decompression functionality affected by Node2Shell (CVE-2026-111497). 
• Other Brotli-dependent software: Applications and runtimes incorporating vulnerable Brotli implementations.

Summary 

In October 2026, the Node.js project released security updates for its 22.x, 24.x, and 26.x release lines, fixing a total of 10 vulnerabilities: one rated Critical, three High, three Medium, and three Low in severity.

The highest severity issue fixed in this release [1] is Critical [5] with CVSS(v4.0) score of 9.2 for CVE-2026-111497(Node2Shell). Other notable vulnerabilities addressed in this security release include CVE-2026-105482 (CVSS v3.0: 7.2), CVE-2026-105483 (CVSS v3.0: 7.4), and CVE-2026-106069 (CVSS v3.0: 7.4), all classified as High severity [6][7][8]. 

eMudhra CA compromise: This is a separate certificate authority incident, node.js updated its bundled CA certificate store to remove trust in the affected intermediate certificates i.e, eight compromised intermediate certificate authority keys, from the Indian CA Certificate  provider eMudhra.

Technical Details 

CVE-2026-111497, aka Node2Shell, Google Brotli Unchecked Return Value Vulnerability, a remote unauthenticated attacker can exploit out-of-bounds write vulnerability in the Brotli decoder (`c/dec/decode.c`) bundled with node.js by providing a crafted Brotli-compressed stream to corrupt adjacent decoder state memory i.e, writing past the end of an internal decoder buffer, may disclose sensitive memory contents, cause a denial of service, or potentially remote code execution.

CVE-2026-105482, Node.js DNS Resolution NUL Byte Truncation Vulnerability, an unauthenticated attacker can exploit a hostname validation bypass vulnerability in Node.js DNS resolution functions {`dns.resolve*()` and `dns.reverse()`} by supplying a hostname containing a NUL byte, causing the hostname to be silently truncated and potentially bypass domain allowlist validation, resolving an unintended hostname. 

CVE-2026-105483 and CVE-2026-106069

Both, Node.js TLS Hostname Verification Bypass Vulnerabilities:

1. CVE-2026-105483 allows an unauthenticated attacker to exploit improper TLS certificate hostname verification by specifying an IPv4 address using non-ASCII characters, such as fullwidth digits (１２７.0.0.1), where tls.checkServerIdentity() fails to recognize such hosts as IP addresses, potentially causing Node.js to accept a server certificate that lacks a matching IP address in its Subject Alternative Name (SAN) and gets accepted for an IP endpoint it was not issued for. 
2. CVE-2026-106069 involves inconsistent parsing of non-canonical IPv4 addresses with leading zero (0127.0.0.1) between Node.js TLS hostname verification and the operating system’s resolver, where tls.checkServerIdentity() function interprets an IPv4 octet as octal during the process of normalisation (WHATWG URL parsing rules) .i.e, 0127.0.0.1 to 87.0.0.1. This results in certificate validation against a different IP address from the one to which the client connects.

Exploitation in the Wild

As of now, CVE-2026-111497 (Node2Shell) has been added to CISA’s Known Exploited Vulnerabilities[2] catalog, indicating evidence of active exploitation in the wild. Public proof-of-concept (PoC) exploits have also been reported for this CVE. For CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069, we could not verify any reports of exploitation in the wild.

Fixed versions

These versions include fixes for the vulnerabilities discussed above. Organizations should use the latest available security-patch released.

• v26.12.1 for 26.x release line
  
• v24.22.1 for 24.x release line
  
• v22.23.4 for 22.x release line

Recommendation

The following actions are recommended to mitigate these vulnerabilities and strengthen security:

• Upgrade Node.js: Install the applicable fixed release to correct the hostname-verification behavior.
• Use canonical IP addresses: Represent IPv4 addresses in standard dotted-decimal notation. Reject non-canonical, or non-ASCII address representations where an IP address is expected.
• Use proper certificate SANs: Ensure certificates contain the appropriate identity in the Subject Alternative Name extension. For IP-address connections, use an IP-address SAN rather than relying on a DNS SAN.
• Preserve TLS verification: Do not disable certificate validation or set rejectUnauthorized: false as a workaround.
• Review custom TLS callbacks: Audit custom implementations of checkServerIdentity() and any code that overrides or bypasses default certificate verification.
• Validate outbound connections: Applications that accept user-supplied URLs should validate hostnames and destination addresses against their security policies.
• Apply network-level restrictions: Restrict access to sensitive internal services and administrative endpoints, even when application-level hostname validation is present. 

References

1. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
2. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
3. https://github.com/google/brotli/releases/tag/v1.1.1 
4. https://github.com/google/brotli/releases/tag/v1.2.1 
5. https://nvd.nist.gov/vuln/detail/cve-2026-111497
6. https://nvd.nist.gov/vuln/detail/cve-2026-105482
7. https://nvd.nist.gov/vuln/detail/cve-2026-105483
8. https://nvd.nist.gov/vuln/detail/cve-2026-106069