CVE-2026-106069: CVE-2026-106069 (Node.js October 2026 Security Emergency)

Executive Summary & Technical Impact

A deep technical breakdown of the October 2026 Node.js security releases addressing a critical out-of-bounds write in the bundled Brotli decoder and NUL byte DNS truncation.

Tracked under CVE-2026-106069 (CWE-Other (Security Advisory)), this vulnerability affects Node.js 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1 (Node 20 EOL) and carries a severity score of 9.8 (CRITICAL). Engineering and security operations teams running Node.js Infrastructure should prioritize upgrading to 22.23.4, 24.22.1, 26.12.1.

Remediation & Patch Guidance

1. CVE-2026-111497 (CVSS 9.8 Critical): An out-of-bounds write vulnerability in the C Brotli library bundled inside node:zlib enables Remote Code Execution (RCE) or memory disclosure when decompressing untrusted Brotli streams.
2. CVE-2026-105482 & CVE-2026-105483: Hostname truncation via injected NUL bytes in dns.resolve*() and a TLS certificate hostname verification bypass using fullwidth IPv4 digits.
3. All active release lines are patched: upgrade immediately to Node.js v22.23.4 (LTS), v24.22.1 (LTS), or v26.12.1 (Current). Node.js 20 has reached End-of-Life (EOL) and receives no fix.
4. Managed serverless and edge platforms such as Vercel have deployed platform-level mitigations, but self-hosted Docker containers and VMs require immediate image updates.

Frequently Asked Questions (CVE-2026-106069)

What versions are affected by CVE-2026-106069?

CVE-2026-106069 affects Node.js 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1 (Node 20 EOL) in Node.js Infrastructure (CVE-2026-106069 (Node.js October 2026 Security Emergency)).

How do I patch or remediate CVE-2026-106069?

Upgrade affected deployments to 22.23.4, 24.22.1, 26.12.1 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-106069?

CVE-2026-106069 is rated CRITICAL with a CVSS score of 9.8 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).