Node.js Fixes High-Severity Flaws Across Three Release Branches
Photo: TokenPost
The Node.js project issued security releases for its 26.x, 24.x and 22.x lines on Oct. 21, fixing 10 vulnerabilities, including a high-severity flaw that can enable remote code execution. Crypto platforms using Node.js in their back-end systems should check which release branch they run. Tracked as CVE-2026-111497, the flaw is in Brotli decompression and involves an out-of-bounds write. It affects all three branches. The fixes are included in Node.js 26.12.1, 24.22.1 and 22.23.4, respectively. Four of the 10 issues are high severity, while three are medium and three are low.
Source: TokenPost
