Node.js: Critical RCE in Brotli decoder, CloudLinux updates alt-nodejs

Node.js released versions v22.23.4, v24.22.1 and v26.12.1 on 21 October 2026, which patch 10 vulnerabilities. For those managing shared hosting on CloudLinux, the important news isn't the upstream release, but the release of alt-nodejs packages: on 21 October 2026 the Node.js project published security releases for the 22.x, 24.x and 26.x branches (v22.23.4, v24.22.1, v26.12.1), but on CloudLinux the fix only arrives when those packages are recompiled and installed.

The most severe flaw: Brotli out-of-bounds write

A defect in Node.js can cause an out-of-bounds write in the Brotli decoder that enables remote code execution (CVE-2026-111497). This is not a lab-based flaw: the Brotli decompression vulnerability enables remote code execution and is trivial to trigger because fetch() and Express 5 automatically decompress Brotli responses. On CloudLinux, updating the system brotli package won't help: alt-nodejs builds carry their own copy of the library, so only the updated alt-nodejs package closes the issue.

In total the 10 CVEs affect HTTP, DNS, TLS, crypto and the permissions model:

CVE	Issue	Severity	Affected branches
CVE-2026-111497	Brotli decoder, out-of-bounds write, RCE	High	26.x, 24.x, 22.x
CVE-2026-105482	dns.resolve truncates names with NUL character	High	26.x, 24.x, 22.x
CVE-2026-105483	TLS hostname bypass with fullwidth digits	High	26.x, 24.x
CVE-2026-106069	TLS hostname bypass on hosts resolving to IP	High	26.x, 24.x, 22.x
CVE-2026-105481	Socket keep-alive processes pre-request response	Medium	26.x, 24.x, 22.x
CVE-2026-106072	Certificate validation for non-canonical IPv4	Medium	26.x, 24.x, 22.x
CVE-2026-106074	randomUUID/randomInt entropy caching in snapshot	Medium	26.x, 24.x, 22.x
CVE-2026-106070	ZipFile returns bytes after invalid ZIP header	Low	26.x
CVE-2026-106071	Permission Model, filesystem over-grant	Low	26.x
CVE-2026-106073	Permission Model, bypass via fs.realpathSync	Low	26.x, 24.x, 22.x

What changes on a CloudLinux server

End-of-life versions remain affected: Node.js warns that unsupported branches are always included in security releases, and CloudLinux repackages them anyway. After the update, applications remain on the old binary until they are restarted:

rpm -qa 'alt-nodejs*'
yum update 'alt-nodejs*'
cloudlinux-selector restart --json --interpreter nodejs --user <user> --app-root <app_root>

For end-of-life branches node --version does not change after the update: check the package release with rpm -q alt-nodejs16 and compare against the minimum fixed release.

Package	Minimum correct release
alt-nodejs12	35
alt-nodejs14	37
alt-nodejs16	33
alt-nodejs18	26
alt-nodejs20	15
alt-nodejs22	2
alt-nodejs23	23
alt-nodejs24	2
alt-nodejs26	1

No documented workaround exists for CVE-2026-111497. Whilst waiting for the package for your branch, the only practical mitigation is to prevent your service from decompressing Brotli data from untrusted sources. Release advisories are published on the CloudLinux status page.