Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073
By Roy Kalfon |
21 October 2026
Multiple CVEs – Node.js security release fixes TLS hostname verification bypasses and Brotli decoder RCE
Node.js 26.x, 24.x, 22.x fixes dns.resolve NUL truncation (CVE-2026-105482) and TLS hostname validation bypasses via fullwidth digits (CVE-2026-105483) or loose IP resolution (CVE-2026-106069), plus Brotli decoder OOB write enabling RCE (CVE-2026-111497). Also fixes keep-alive response mix-up (CVE-2026-105481), cert validation flaw (CVE-2026-106072), crypto.randomUUID()/randomInt() snapshot entropy reuse (CVE-2026-106074), ZipFile prefix leak (CVE-2026-106070), Permission Model issues (CVE-2026-106071, CVE-2026-106073). Upgrade to 22.23.4/24.22.1/26.12.1 to mitigate.