Node.js 21-oktabrda uchta qo'llab-quvvatlanadigan reliz liniyasi — 22.x, 24.x va 26.x — uchun xavfsizlik yangilanishlarini e'lon qildi va 10 ta kamchilikni tuzatdi. Eng jiddiy xato — Node.js o'z ichiga olgan Brotli dekompressiya kodidagi xato bo'lib, loyiha ma'lumotiga ko'ra masofaviy kod bajarilishiga (remote code execution) yo'l qo'yishi mumkin, ya'ni hujumchi ta'sirlangan tizimda o'z tanlagan kodini ishga tushirishi mumkin.
Har bir qo'llab-quvvatlanadigan liniya uchun bitta tuzatilgan versiya mavjud: uzoq muddatli qo'llab-quvvatlash liniyalarida 22.23.4 va 24.22.1, joriy liniyada esa 26.12.1. Node.js 20.x va undan oldingi versiyalar hayot tsikli tugagan (end of life) va tuzatish olmaydi, shuning uchun ular qo'llab-quvvatlanadigan liniyaga ko'chirilishi kerak.
Brotli xatosi foydalanuvchining o'z dasturida emas, balki Node.js o'z ichiga olgan kodda joylashgan. Node.js bu kodni Brotli ma'lumotlarini dekompressiya qilganda har doim ishga tushiradi — to'g'ridan-to'g'ri node:zlib moduli orqali yoki kod Brotli siqish bilan yuborilgan javobga fetch() chaqirganida avtomatik ravishda.
Ilova hujumchi nazorat qiladigan Brotli ma'lumotlarini dekompressiya qilganda, masalan, so'rov tanasi (request body) yoki boshqa serverdan olingan javob orqali, ta'sirlanadi.
Brotli xatosi
Xato Brotli dekoderidagi buferdan tashqari yozuv (out-of-bounds write) bo'lib, noto'g'ri siqilgan kirish ma'lumotlari bilan ishga tushadi. Tuzatish Brotli loyihasidan olingan yuqori darajadagi yamoq bo'lib, Node.js uni nusxalagan; u dekoderga noto'g'ri kirishni aniqlash va buferdan tashqariga yozishdan oldinroq to'xtash imkonini beradi.
Brotli — Google'ning siqish kutubxonasi, va Node.js o'z nusxasini jo'natadi. Xuddi shu tuzatish 21-oktabrda Brotli 1.2.1, 1.1.1 va 1.0.10 versiyalarida ham jo'natildi, shuning uchun Brotli'ni o'z ichiga olgan boshqa dasturlar ham xuddi shu yangilanishni talab qilishi mumkin. O'zgarish birinchi marta Brotli manba kodida 2026-yil fevralda kiritilgan va faqat oktyabrda xavfsizlik relizi sifatida jo'natilgan.
"Masofaviy kod bajarilishi" — loyihaning xato nima qilishga yo'l qo'yishi mumkinligi haqidagi tavsifi, va xato tanqidiy (critical) emas, balki yuqori (high) darajada baholangan. Amalda bu qanchalik isbotlanganligi torroq.
22-oktabrda e'lon qilingan ommaviy isbot-konsepsiya (proof-of-concept) faqat ataylab zaiflashtirilgan sinov qurilishiga (test build) qarshi kod bajarilishiga erishdi. Standart Node.js qurilishida uning muallifi xato va jarayon xotirasining cheklangan o'qilishi (limited read of process memory) haqida xabar berdi, kod bajarilishi emas, va normal qurilishda ishlaydigan hujumga erishilmaganini aytdi.
Tuzatilgan Node.js isbot-konsepsiya ishlatadigan noto'g'ri kirishni rad etadi, va 22-oktabr holatiga ko'ra xatodan yovvoyi foydalanish (exploitation in the wild) haqida xabar berilmagan.
Boshqa xatolar
Boshqa tuzatishlardan uchtasi ham yuqori darajada baholangan. Ikkitasi — hujumchi serverning IP manzilini g'ayrioddiy shaklda yozib, TLS sertifikat tekshiruvini chetlab o'tishi mumkin bo'lgan xatolar (CVE-2026-106069 va CVE-2026-105483), shunda sertifikat mos kelmasligi kerak bo'lgan xostga mos keladi. Uchinchisi — dns.resolve funksiyasining ichki null bayt (embedded null byte) bilan xost nomini qisqartirishini to'xtatadi (CVE-2026-105482).
Node.js CVE-2026-105483 ni yuqori darajada baholaydi, garchi uni tuzatgan commit xatoni past darajali va foydalanish qiyin deb ataydi.
Qolganlari o'rta va past darajadagi xatolar. Bir o'rta darajadagi xato — ilova ishga tushirish surati (startup snapshot) yoki yagona bajariladigan ilova (single-executable application) sifatida qurilganda crypto.randomUUID() va crypto.randomInt() har bir jarayonda bir xil qiymatlarni qaytarishiga sabab bo'ladi (CVE-2026-106074), bu esa bu qiymatlarning oldindan aytib bo'lmasligi (unpredictable) kerak bo'lgan har qanday narsani buzadi.
To'liq ro'yxat va har bir xato ta'sir qiladigan liniyalar:
| CVE | Nima | Jiddiylik | Ta'sirlangan liniyalar |
|---|---|---|---|
| CVE-2026-111497 | Brotli dekoderidagi buferdan tashqari yozuv; loyihaga ko'ra masofaviy kod bajarilishi | Yuqori | 22.x, 24.x, 26.x |
| CVE-2026-106069 | Xost IP manzili g'ayrioddiy shaklda bo'lganda TLS xost nomi tekshiruvini chetlab o'tish | Yuqori | 22.x, 24.x, 26.x |
| CVE-2026-105483 | IP to'liq kenglik raqamlari (fullwidth digits) bilan yozilganda TLS xost nomi tekshiruvini chetlab o'tish | Yuqori | 24.x, 26.x |
| CVE-2026-105482 | dns.resolve null bayt o'z ichiga olgan nomlarni qisqartiradi | Yuqori | 22.x, 24.x, 26.x |
| CVE-2026-105481 | Keep-alive soket so'rov yuborilishidan oldin yozilgan javobni qayta ishlashi mumkin | O'rta | 22.x, 24.x, 26.x |
| CVE-2026-106072 | G'ayrioddiy IPv4 uchun sertifikat tekshiruvi DNS nomlariga IP nuqtalarini autentifikatsiya qilishga ruxsat beradi | O'rta | 22.x, 24.x, 26.x |
| CVE-2026-106074 | randomUUID() va randomInt() ishga tushirish suratlari va yagona bajariladigan ilovalarda qayta ishlatiladigan kesh | O'rta | 22.x, 24.x, 26.x |
| CVE-2026-106070 | ZipFile muvaffaqiyatsiz sarlavha tekshiruvidan so'ng hujumchi nazorat qiladigan baytlarni qaytaradi | Past | 26.x |
| CVE-2026-106071 | Ruxsat modeli (Permission Model) joker belgisi (wildcard) orqali faylga kirishni ortiqcha beradi | Past | 26.x |
| CVE-2026-106073 | Ruxsat modeli fs.realpathSync bilan chetlab o'tiladi | Past | 22.x, 24.x, 26.x |
eMudhra sertifikat blokirovkasi
Xuddi shu yangilanishlar, shuningdek, bir necha kun oldin buzilgan deb xabar qilingan hindistonlik eMudhra provayderining sakkizta oraliq sertifikat vakolat kalitlarini (intermediate certificate authority keys) Node.js ishonmasligini to'xtatadi.
Node.js Mozilla ildiz sertifikat ro'yxatidan foydalanadi, lekin odatda bekor qilish tekshiruvini (revocation checks) bajarmaydi, shuning uchun bu yangilanishdan oldin buzilgan kalitlardan biriga asoslangan sertifikat zanjiri hali ham o'tardi.
Relizlar sakkizta kalitga o'rnatilgan blokni qo'shadi va uchta emSign ildizini olib tashlash uchun o'rnatilgan ildiz ro'yxatini yangilaydi. Go ham 20-oktabrda o'z yangilanishida xuddi shu blokni amalga oshirdi.
Yangilanishdan oldin boshlangan sessiyadan qayta tiklangan ulanishlar (resumed connections) sessiya tugaguncha qayta tekshirilmaydi, va hayot tsikli tugagan liniyalar blokni olmaydi.
Yangilangan bog'liqliklar
10 ta xatodan tashqari, yangilanishlar bir nechta o'rnatilgan qismlarni ham yangilaydi. fetch() ortidagi HTTP mijozi undici nusxasi uchta o'rta darajadagi maslahatni tuzatuvchi versiyaga ko'chiriladi: biri Subresource Integrity tekshiruvida va ikkitasi xotira tugash (memory-exhaustion) xatolari, ulardan biri Node.js ichiga o'rnatilgan WebSocket mijozida.
Node.js, shuningdek, barcha liniyalarda o'rnatilgan c-ares, 22.x va 24.x da OpenSSL, va 22.x da SQLite ni ommaviy ma'lum zaifliklar uchun tuzatishlar bilan yangiladi.
Agar hozircha yangilay olmasangiz
Yangilash — tuzatish. Maslahat Brotli xatosi uchun vaqtinchalik yechim (temporary workaround) taklif qilmaydi, shuning uchun darhol yangilay olmaydigan ilova Node.js ichida o'zi uchun zaxira variantga ega emas.
Mijozlari uchun Node.js ni ishga tushiradigan Vercel 21-oktabrda kiruvchi so'rovlarda hujumni bloklaydigan xavfsizlik devori qoidalarini (firewall rules) qo'shganini aytdi. Qoidalar ilova boshqa serverlardan oladigan Brotli javoblarini qamrab olmaydi va yangilash o'rnini bosmaydi.
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix, so they should be moved to a supported line.
The Brotli flaw is in code Node.js bundles, not in a user's own program. Node.js runs that code whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when code calls fetch() on a response sent with Brotli compression.
An application is exposed where it decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server.
The Brotli Flaw
The flaw is an out-of-bounds write in the Brotli decoder, set off by malformed compressed input. The fix is an upstream patch from the Brotli project that Node.js copied in, and it makes the decoder catch invalid input and stop earlier rather than writing past the buffer.
Brotli is Google's compression library, and Node.js ships its own copy. The same fix shipped in Brotli 1.2.1, 1.1.1, and 1.0.10 on October 21, so other software that bundles Brotli may need the same update. The change was first made in Brotli's source in February 2026 and shipped as a security release only in October.
"Remote code execution" is the project's description of what the flaw could allow, and the flaw is rated high rather than critical. How far that has been shown in practice is narrower.
A public proof-of-concept published on October 22 reached code execution only against a deliberately weakened test build. On a standard Node.js build, its author reported a crash and a limited read of process memory, not code execution, and said a working attack on a normal build was not achieved.
Patched Node.js rejects the malformed input the proof-of-concept uses, and no exploitation of the flaw in the wild has been reported as of October 22.
The Other Flaws
Three of the other fixes are also rated high. Two are TLS certificate checks an attacker could bypass by writing a server's IP address in an unusual form, so a certificate matches a host it should not (CVE-2026-106069 and CVE-2026-105483). The third stops dns.resolve from cutting a hostname short at an embedded null byte (CVE-2026-105482).
Node.js rates CVE-2026-105483 high, though the commit that fixed it calls the bug low-severity and hard to exploit.
The rest are medium and low severity. One medium flaw makes crypto.randomUUID() and crypto.randomInt() hand back the same values in every process when an application is built as a startup snapshot or a single-executable application (CVE-2026-106074), which undermines anything that relies on those values being unpredictable.
The full set, and the lines each one affects:
| CVE | What it is | Severity | Affected lines |
|---|---|---|---|
| CVE-2026-111497 | Out-of-bounds write in the Brotli decoder; remote code execution, per the project | High | 22.x, 24.x, 26.x |
| CVE-2026-106069 | TLS hostname-check bypass when a host resolves to an IP address in non-canonical form | High | 22.x, 24.x, 26.x |
| CVE-2026-105483 | TLS hostname-check bypass when an IP is written in fullwidth digits | High | 24.x, 26.x |
| CVE-2026-105482 | dns.resolve truncates names that contain a null byte | High | 22.x, 24.x, 26.x |
| CVE-2026-105481 | Keep-alive socket can process a response written before the request was sent | Medium | 22.x, 24.x, 26.x |
| CVE-2026-106072 | Certificate validation for non-canonical IPv4 lets DNS names authenticate IP endpoints | Medium | 22.x, 24.x, 26.x |
| CVE-2026-106074 | randomUUID() and randomInt() caches reused in startup snapshots and single-executable apps | Medium | 22.x, 24.x, 26.x |
| CVE-2026-106070 | ZipFile returns attacker-controlled bytes after a failed header check | Low | 26.x |
| CVE-2026-106071 | Permission Model over-grants file access through a wildcard lookup | Low | 26.x |
| CVE-2026-106073 | Permission Model bypass with fs.realpathSync | Low | 22.x, 24.x, 26.x |
The eMudhra Certificate Block
The same updates also stop Node.js from trusting eight intermediate certificate authority keys from the Indian provider eMudhra that were reported compromised days earlier.
Node.js uses the Mozilla root certificate list but does not perform revocation checks by default, so before this update, a certificate chain built on one of the compromised keys still passed.
The releases add a built-in block on the eight keys and update the bundled root list to remove three emSign roots. Go made the same block in its own update on October 20.
Connections resumed from a session that began before the update are not re-checked until that session times out, and end-of-life lines do not get the block.
Updated Dependencies
Beyond the 10 flaws, the updates refresh several bundled parts. The copy of undici, the HTTP client behind fetch(), moves to a version that fixes three moderate advisories: one in its Subresource Integrity check and two memory-exhaustion flaws, one of them in the WebSocket client built into Node.js.
Node.js also updated its bundled c-ares on all lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x, to include fixes for publicly known vulnerabilities.
If You Cannot Upgrade Yet
Upgrading is the fix. The advisory offers no temporary workaround for the Brotli flaw, so an application that cannot upgrade immediately has no fallback within Node.js itself.
Vercel, which runs Node.js for its customers, said it added firewall rules on October 21 that block the attack in inbound requests. The rules do not cover Brotli responses an application fetches from other servers, and do not replace upgrading.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.