GoPlus Security 🚦 · 2026-10-22 03:33 UTC

🚨 GoPlus Security Alert: Node.js October 2026 Security Updates On Oct 21, Node.js patched 10 vulnerabilities: 4 high-, 3 medium-, and 3 low-severity. CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It can lead to remote code execution when an app processes untrusted compressed data. The other high-severity issues are `dns.resolve` truncating domain names that contain NUL characters, and two TLS certificate hostname-verification bypasses. The medium- and low-severity issues cover Keep-alive response handling, repeated random values, ZIP file handling, and the permission model. Patched releases: Node.js 22.23.4, 24.22.1, 26.12.1. Affected release lines vary by vulnerability. Running Node.js does not by itself mean there is an exploitable entry point. ⚠️ Checks and mitigation steps 1. Know what is actually running. Inventory the Node.js executable and image source actually in use across services, nodes, and containers, and check every replica. The version reported by a local `node -v` command may differ from the version used by the application process. 2. Prioritize upgrades based on exposure. Prioritize services that decode Brotli-compressed data from external sources, or that use untrusted input to construct DNS queries or specify HTTPS/TLS connection targets. Move to the patched release for that branch, or a verified vendor backport. Then restart and verify the running version on every node. 3. If you cannot upgrade now, restrict exposed inputs. Restrict the processing of untrusted compressed data, and limit which connection targets can be specified through untrusted input. Review logs for decoding errors, abnormal process behavior, and certificate alerts. These measures do not replace a runtime update.

Loading the story on Tree News…