Node.js Issues Security Releases for 26.x, 24.x and 22.x Fixing High-Severity TLS and Brotli Flaws
Node.js released security updates on 21 October 2026 for the 26.x, 24.x and 22.x branches. The fixes address high-severity vulnerabilities in TLS hostname validation and the Brotli decoder while also updating key dependencies such as OpenSSL and Undici.
The most critical changes involve several bypasses in TLS certificate hostname verification. In 26.x and 24.x, verification can fail when an IP address is represented with full-width digits (CVE-2026-105483). A related bypass present in all three branches occurs when a host resolves loosely to an IP address (CVE-2026-106069). Another medium-severity issue allows authentication of non-canonical IPv4 hostnames against DNS SANs (CVE-2026-106072).
A high-impact flaw in the Brotli decoder permits an out-of-bounds write that could lead to remote code execution (CVE-2026-111497). Services exposed to the internet or that accept compressed responses should be prioritised for patching.
Additional network-related fixes include CVE-2026-105481, which corrects a keep-alive socket behaviour allowing responses to be processed before the corresponding request is sent, and CVE-2026-105482, which addresses truncation of names containing NUL characters in dns.resolve.
Further changes cover entropy caching in crypto.randomUUID() and randomInt() that could cause repeated values across processes after snapshot or SEA reuse (CVE-2026-106074). Low-severity fixes in 26.x address ZipFile (CVE-2026-106070) and excessive permission grants via radix wildcard lookups in the filesystem permission model (CVE-2026-106071). All three branches resolve a fs.realpathSync permission model bypass (CVE-2026-106073).
Dependency updates mitigate known issues in c-ares, Undici, OpenSSL, SQLite and the ca-cert bundle following the compromise of an eMudhra intermediate CA. Administrators are advised to update immediately, beginning with perimeter services, and to review container images and non-standard TLS or DNS configurations.
Related articles
Atlassian October Security Bulletin Flags 176 Third-Party Library Vulnerabilities Across Jira, Confluence and Bitbucket
Atlassian released its October security bulletin detailing 176 vulnerability entries distributed across seven products including Jira, Confluence, Bamboo, Bitbucket, Crowd, Fisheye and Crucible. Of these, 162 entries carry high severity and 14 are rated critical, though the total does not represent 176 unique flaws because the same identifiers recur when multiple products share the same third-party library. All critical issues originate in external components rather than Atlassian code, with the most severe being CVE-2026-65637 in the Coyote component of Apache Tomcat used by Confluence, which allows interception of server-client connections. Affected versions and corresponding fixes were published for Confluence Data Center, Bamboo, Bitbucket Data Center, Jira Software and Jira Service Management, with the company stressing that administrators must compare exact build numbers against the full corrected-version table. No exploitation of the listed issues had been reported as of 22 October, and Atlassian classifies the inherited exposure from third-party libraries as lower priority, issuing separate critical alerts only for immediate-risk cases.
Node.js Addresses 10 Vulnerabilities Including High-Severity RCE Risk in Brotli Decompression
The Node.js development team disclosed ten vulnerabilities across multiple versions of the JavaScript runtime on October 21, 2026. Four of the issues received a High severity rating, with one carrying a remote code execution risk through improper handling of Brotli-compressed data. The flaw tracked as CVE-2026-111497 affects Node.js 26.x, 24.x, and 22.x branches and stems from out-of-bounds memory writes during decompression. Additional High-severity problems involve DNS name resolution truncation when NUL characters are present and hostname verification bypasses in TLS certificate validation. The project also resolved three Medium and three Low severity issues related to certificate validation, snapshot entropy reuse, and file-access permission checks. Updated releases Node.js 26.12.1, 24.22.1, and 22.23.4 incorporate fixes for both the core issues and vulnerabilities in bundled components such as c-ares, OpenSSL, SQLite, and Undici. Users of unsupported older branches are advised to migrate to currently maintained versions.
HPE Discloses 72 Vulnerabilities in AOS-10 and AOS-8 Wireless LAN Operating Systems, 33 Rated Critical
Hewlett Packard Enterprise has published a security advisory detailing 72 vulnerabilities affecting its wireless LAN operating systems AOS-10 and AOS-8. The flaws impact mobility controllers, gateways, access points, and virtual machines running these platforms. Thirty-three of the issues received the highest severity rating of Critical, with eight vulnerabilities scoring the maximum CVSSv3.1 base score of 10.0. Specific examples include a buffer overflow tracked as CVE-2026-79847 in AOS-10, plus command injection and SQL injection flaws in AOS-8 that allow unauthenticated remote code execution. No exploitation of these vulnerabilities has been observed at the time of disclosure. The advisory was released on October 22, 2026, and organizations are urged to apply available patches promptly.
Mitigating PHP2Shell RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Legacy PHP 5.6 Stacks with Varnish, Docker and Apache mod_php
Two critical remote code execution vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) affect PHP before any application code executes, targeting the Zend Engine's longjmp() mechanism during OOM conditions and use-after-free issues with session upload progress. Official patches exist only for supported branches 8.2.35 and newer, leaving PHP 5.6 installations exposed, especially those using Apache with mod_php. An administrator of a high-traffic legacy enterprise application running PHP 5.6 inside Docker containers behind Varnish implemented a four-layer defense without rewriting the monolith. The approach disables session.upload_progress.enabled and sets memory_limit to -1 inside PHP, enforces strict cgroups memory limits and MaxConnectionsPerChild 1 in Apache, adds request-size and cookie-based blocks in Varnish VCL, and forces Connection: close on synthetic error responses. Testing revealed HTTP keep-alive drain issues and differing behavior between direct Apache requests and Varnish-routed traffic. The layered controls successfully neutralize both attack vectors while preserving production stability.