Node.js loyihasi 2026-yil 21-oktabrda xavfsizlik yangilanishlarini e'lon qildi va 26.x, 24.x hamda 22.x reliz liniyalarida 10 ta zaiflikni bartaraf etdi.
Yangilanishlar masofaviy kod bajarilishiga (RCE) imkon beradigan muhim Brotli dekoder kamchiligini, shuningdek DNS yechimi, TLS sertifikat tekshiruvi, kriptografik tasodifiylik va fayl tizimi ruxsatlari bilan bog'liq zaifliklarni tuzatadi.
Reliz to'rtta yuqori darajadagi, uchta o'rta darajadagi va uchta past darajadagi zaiflikni bartaraf etadi. Tuzatilgan versiyalar: Node.js 26.12.1, 24.22.1 va 22.23.4.
Garchi uchala reliz liniyasi ham xavfsizlik yangilanishlarini olgan bo'lsa-da, alohida zaifliklar turli tarmoqlarga ta'sir qiladi, shuning uchun versiyaga xos baholash muhim.
Eng muhim muammo — CVE-2026-111497 — Node.js Brotli dekoderidagi chegaradan tashqari yozuv (out-of-bounds write) bo'lib, u masofaviy kod bajarilishiga imkon beradi. Node.js 26.x, 24.x va 22.x versiyalari ta'sirlangan. Zaiflikni dasturchi mcollina xabar qilgan, aduh95 esa tuzatishni amalga oshirgan.
Maslahat hujjatida ekspluatatsiya uchun zarur shartlar, yuklama (payload) xususiyatlari yoki faol ekspluatatsiya dalillari haqida batafsil ma'lumot berilmagan.
Shuning uchun bu e'lon ta'sirlangan relizni ishlatayotgan har bir ilova masofadan ekspluatatsiya qilinishi mumkin deb talqin qilinmasligi kerak. Tasdiqlangan doira dekoder zaifligi va uchta ta'sirlangan reliz liniyasi bilan cheklangan.
Yana uchta yuqori darajadagi muammo hostname (xost nomi) bilan ishlashga tegishli:
- CVE-2026-105482:
dns.resolveNUL belgilarini o'z ichiga olgan nomlarni qisqartiradi. - CVE-2026-105483: IP manzil to'liq kenglikdagi raqamlardan foydalanganda TLS sertifikat xost nomi tekshiruvi chetlab o'tiladi.
- CVE-2026-106069: IP manzillarga yumshoq (loose) tarzda yechiladigan xostlarga ta'sir qiladi.
Quyidagi jadval loyihaning xavfsizlik e'lonida batafsil keltirilganidek, barcha 10 ta zaiflik va ularning ta'sirlangan reliz liniyalarini umumlashtiradi. Jiddiylik belgilari loyihaning tasniflarini aks ettiradi, mustaqil ravishda tayinlangan xavf ballari emas.
| CVE | Jiddiylik | Texnik muammo | Ta'sirlangan tarmoqlar |
|---|---|---|---|
| CVE-2026-105482 | Yuqori | dns.resolve da NUL-belgi qisqartirilishi | 26.x, 24.x, 22.x |
| CVE-2026-105483 | Yuqori | To'liq kenglikdagi IP raqamlari yordamida TLS xost nomi chetlab o'tilishi | 26.x, 24.x |
| CVE-2026-106069 | Yuqori | Yumshoq IP yechimi bilan bog'liq TLS xost nomi chetlab o'tilishi | 26.x, 24.x, 22.x |
| CVE-2026-111497 | Yuqori | Brotli chegaradan tashqari yozuvi, RCE ga imkon beradi | 26.x, 24.x, 22.x |
| CVE-2026-105481 | O'rta | Keep-alive soket so'rovdan oldin javobni qabul qiladi | 26.x, 24.x, 22.x |
| CVE-2026-106072 | O'rta | DNS SAN lar kanonik bo'lmagan IPv4 nuqtalarini autentifikatsiya qiladi | 26.x, 24.x, 22.x |
| CVE-2026-106074 | O'rta | Suratga olingan entropiya keshlarida tasodifiy qiymatlar takrorlanadi | 26.x, 24.x, 22.x |
| CVE-2026-106070 | Past | ZipFile tekshiruv muvaffaqiyatsizligidan so'ng hujumchi nazoratidagi prefiksni qaytaradi | 26.x |
| CVE-2026-106071 | Past | Wildcard radix qidiruvi fayl tizimi ruxsatlarini ortiqcha beradi | 26.x |
| CVE-2026-106073 | Past | fs.realpathSync orqali Ruxsat Modeli chetlab o'tilishi | 26.x, 24.x, 22.x |
CVE-2026-106074 crypto.randomUUID() va randomInt() tomonidan ishlatiladigan entropiya keshlariga ta'sir qiladi. Bu keshlar foydalanuvchi hududidagi (user-land) ishga tushirish suratlari (startup snapshots) va yagona bajariladigan ilovalarda saqlanishi mumkin, natijada jarayonlar bir xil qiymatlarni takrorlaydi. Bu muammo har bir kriptografik operatsiyaning umumiy muvaffaqiyatsizligi emas, balki jarayonlar orasida keshga olingan tasodifiylikning takrorlanishi bilan bog'liq.
Reliz shuningdek uchala tarmoqda c-ares, Undici va CA sertifikatlarini yangilaydi. Sertifikat yangilanishi eMudhra Intermediate CA buzilishini bartaraf etadi.
OpenSSL 24.x va 22.x versiyalarida yangilanadi, SQLite esa 22.x versiyasida yangilanadi. Bu bog'liqlik o'zgarishlari ro'yxatga olingan Node.js zaifliklari bilan birga keladi.
Ma'murlar ta'sirlangan o'rnatmalarni o'z reliz tarmog'iga qarab Node.js 26.12.1, 24.22.1 yoki 22.23.4 versiyalariga yangilashlari kerak. Loyiha hayot tsikli tugagan (end-of-life) versiyalar xavfsizlik relizlaridan keyin ham ta'sirlangan bo'lib qolishini ogohlantiradi va foydalanuvchilarga qo'llab-quvvatlanadigan versiyalarga o'tishni maslahat beradi.
E'lon bu kamchiliklar uchun hech qanday vaqtinchalik yechim (workaround) taklif qilmaydi, shuning uchun tuzatilgan ish vaqti (runtime) o'rnatish ko'rsatilgan tarmoqlardagi ta'sirlangan o'rnatmalar uchun tavsiya etilgan tuzatish usuli hisoblanadi.
The Node.js Project released security updates on October 21, 2026, addressing 10 vulnerabilities across its 26.x, 24.x, and 22.x release lines.
The updates fix a critical Brotli decoder flaw that allowsremote code execution, as well as weaknesses in DNS resolution, TLS certificate validation, cryptographic randomness, and filesystem permissions.
The release addresses four high-severity, three medium-severity, and three low-severity vulnerabilities. The patched versions are Node.js 26.12.1, 24.22.1, and 22.23.4.
Although all three release lines have received security updates, individual vulnerabilities affect different branches, making version-specific assessments important.
The most significant issue, CVE-2026-111497, involves an out-of-bounds write in the Node.js Brotli decoder that allows remote code execution. Node.js versions 26.x, 24.x, and 22.x are affected. Developer mcollina reported the vulnerability, and aduh95 implemented the fix.
The advisory does not provide detailed prerequisites for exploitation, payload characteristics, or evidence of active exploitation.
Therefore, the disclosure should not be interpreted as indicating that every application running an affected release is remotely exploitable. The confirmed scope is limited to the decoder vulnerability and the three affected release lines.
Three additional high-severity issues concern hostname handling:
- CVE-2026-105482 causes dns.resolve to truncate names containing NUL characters.
- CVE-2026-105483 bypasses TLS certificate hostname checks when an IP address uses full-width digits.
- CVE-2026-106069 affects hosts that loosely resolve to IP addresses.
The following table summarizes all 10 vulnerabilities and their affected release lines, as detailed in the project’s security announcement. Severity labels reflect the project’s classifications rather than independently assigned risk scores.
| CVE | Severity | Technical issue | Affected branches |
|---|---|---|---|
| CVE-2026-105482 | High | NUL-character truncation in dns.resolve | 26.x, 24.x, 22.x |
| CVE-2026-105483 | High | TLS hostname bypass using fullwidth IP digits | 26.x, 24.x |
| CVE-2026-106069 | High | TLS hostname bypass involving loose IP resolution | 26.x, 24.x, 22.x |
| CVE-2026-111497 | High | Brotli out-of-bounds write permitting RCE | 26.x, 24.x, 22.x |
| CVE-2026-105481 | Medium | Keep-alive socket accepts response preceding request | 26.x, 24.x, 22.x |
| CVE-2026-106072 | Medium | DNS SANs authenticate noncanonical IPv4 endpoints | 26.x, 24.x, 22.x |
| CVE-2026-106074 | Medium | Snapshotted entropy caches repeat random values | 26.x, 24.x, 22.x |
| CVE-2026-106070 | Low | ZipFile returns attacker-controlled prefix after validation failure | 26.x |
| CVE-2026-106071 | Low | Wildcard radix lookup over-grants filesystem permissions | 26.x |
| CVE-2026-106073 | Low | Permission Model bypass through fs.realpathSync | 26.x, 24.x, 22.x |
CVE-2026-106074 affects the entropy caches used by crypto.randomUUID() and randomInt(). These caches can be preserved in user-land startup snapshots and single-executable applications, causing processes to repeat the same values. This issue concerns duplicated cached randomness across processes rather than a general failure of every cryptographic operation.
The release also updatesc-ares, Undici, and CA certificates across all three branches. The certificate update addresses the eMudhra Intermediate CA compromise.
OpenSSL is updated in versions 24.x and 22.x, whileSQLite is updatedin version 22.x. These dependency changes accompany the listed Node.js vulnerabilities.
Administrators should upgrade affected deployments to Node.js versions 26.12.1, 24.22.1, or 22.23.4, depending on their release branch. The project warns that end-of-life versions remain affected even after security releases and advises users to switch to maintained versions.
The announcement offers no workarounds for these flaws, so installing the patched runtime is the recommended remediation for affected deployments across the specified branches.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.