Node.js patches ten vulnerabilities across 22.x, 24.x and 26.x, led by high-severity Brotli flaw

Node.js ships October security releases

On October 21, 2026, Node.js published security releases for its 22.x, 24.x and 26.x lines, closing ten vulnerabilities, four of them rated high severity. The headline fix targets the Brotli decompressor, where manipulated compressed data can trigger an out-of-bounds write. The details were documented by the Total.js project in a security write-up on dev.to, which also records how the framework team responded to the advisory.

What was fixed

According to the Total.js write-up, the batch of fixes covers:

• Brotli decoder (node:zlib), high severity: crafted compressed data can cause an out-of-bounds write. Depending on how an application handles untrusted input, the impact ranges from a crash to the disclosure of memory contents.
• DNS resolution (dns.resolve*()), high severity: a hostname containing a NUL byte gets truncated, meaning a name that passed validation can end up resolving to an entirely different host.
• tls.checkServerIdentity(), rated high or medium: IPv4 addresses written in unusual forms — non-ASCII digits, leading zeros, hexadecimal shorthand such as 0x7f.0.0.1, or abbreviations like 127.1 — can be interpreted differently by the certificate check than by the operating system.
• The HTTP keep-alive agent, medium severity: an unsolicited response left sitting on a reused socket can be accepted as the answer to a subsequent request.
• Snapshots, the permission model and ZIP file reading, medium to low: narrow issues in features most applications do not touch.

An AI-assisted discovery

The Brotli flaw was reported by Codex Security, an OpenAI tool the write-up describes as AI-assisted, working alongside two independent security researchers; Node.js maintainers produced the fix. The Total.js post presents this as a snapshot of how security research is changing: machine-assisted tooling surfaces suspicious behaviour in complex code, while people validate the findings and coordinate the patches with maintainers.

Total.js hardens hostname handling

The vulnerabilities sit in the Node.js runtime rather than in frameworks built on top of it, and Total.js deliberately avoids depending on a specific Node.js version. Even so, the team audited Total.js 4 and Total.js 5 against the advisory and shipped changes that normalise and validate hostnames before they reach DNS or a TLS connection:

• Internationalised domain names are converted to their ASCII punycode form.
• Unusual IP spellings are canonicalised to dotted notation, so 127.1 and 0x7f.0.0.1 both become 127.0.0.1, ensuring the certificate check and the operating system see the same address.
• Names containing NUL bytes, spaces or otherwise invalid addresses are rejected up front with a clear "Invalid hostname" error instead of ever reaching the network.

These checks apply to REQUEST(), U.resolve() and HTTP redirect handling — so a remote server can no longer steer a request toward an odd address via a Location header — as well as U.connect() (also used by LDAP support), the Total.js 4 WebSocket client and the SMTP server in the mail module. Two new utilities, U.validhost() and U.tohost(), let application code reuse the same validation. The team says ordinary hostnames, IPv6 addresses and existing punycode names behave exactly as before, the minimum supported Node.js version has not been raised, and the changes passed the full test suites on Node.js 14, 16, 18, 19, 20, 22, 24 and 26.

The framework itself was never exposed to the Brotli bug, since Total.js only decompresses gzip and deflate. The keep-alive flaw, by contrast, can only be addressed inside the runtime.

What operators should do

The patched releases are Node.js 22.23.4, 24.22.1 and 26.12.1, or later on each line. The post also cautions Docker users: updating the host does not update Node.js inside a container, and tags such as lts or 24 only pick up new builds when you pull and rebuild, so images should be rebuilt, applications restarted and the active version confirmed with node --version. The Total.js team recommends updating to the latest Total.js 4 or 5 release and checking its GitHub repositories for refreshed applications. Any codebase that decompresses Brotli data, resolves or connects to user-supplied hostnames, or uses snapshots or the permission model should treat the runtime upgrade as a priority.

Why it matters

Ten fixes spanning three actively maintained release lines means a large share of the Node.js install base needs to patch, and the Brotli and DNS flaws can affect any service that touches untrusted compressed data or hostnames — a common pattern in proxies, scrapers and webhook handlers. The episode is also a concrete data point in the debate over AI in security work: an AI-assisted tool surfaced a memory-safety bug in a decompression path used worldwide, with humans still doing the validation and patching. Finally, Total.js's response shows a framework can absorb some runtime-level risk for users who cannot upgrade immediately — but only some, since the keep-alive flaw has no framework-level workaround.