Patch Forecast
Amber warning
Patch this week.

CVE-2026-105482

Node.js: access control flaw

Risk score
70/100
CVSS
7.4 v3.0
Exploit chance (30 days)
0.4%
Published
21 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated, enabling attackers to resolve records for a different name than the one validated. This could lead to unintended actions by applications that validate and then resolve hostnames.
Affected
{'products': ['Node.js'], 'packages': [], 'versions': ['26.x', '24.x', '22.x']}
Fix
Upgrade to a fixed version of Node.js
Exploitation
No known exploitation

Story map

Story map: Node.jsTHE FLAWSTHE FIXCVE-2026-105482Access control flawCVSS 7.4 · EPSS 0%CVE-2026-111497Out-of-bounds write can leadto remote code executionCVSS 9.2 · EPSS 1%CVE-2026-48930Access control flawCVSS 9.8 · EPSS 0%CVE-2026-48618Authentication bypassCVSS 6.5 · EPSS 3%FixUpdate to the latest availableversion: 1.0.10 or 1.1.1 or 1.2.1Who is exposed{'product': 'Google Brotli','packages': ['1.0.3', '1.0.4','1.0.5', '1.0.6', '1.0.7', '1.0.8','1.0.9', '1.0.10', '1.1.0', '1.1.1','1.2.0', '1.2.1'], 'versions'…RED · ACT TODAYNode.jsA buffer overflow vulnerabilityin the Brotli decoder of GoogleBrotli versions 1.0.3 through1.2.0 allows a remoteunauthenticated attacker topotentially execute arbitrarycode or cause a denial of service.Where it standsExploitation reported in the press1 outlet covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.21 Oct · Node.js security releasesWednesday, October 21, 2026 Security Releases23 Oct · The Hacker NewsResearchers Demonstrate Node2Shell RCE Exploiton Node.js Build Using Crafted Brotli Data24 Oct · The Hacker NewsBrotli Decoder Flaw Behind Node.js RCE AlsoAffects Bun, Python and Other Widely UsedSoftwareCONNECTS TOSame weaknessAccess control flaw (CWE-284)324 other warnings in 30 days →Same productEarlier Node.js warnings11 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Node.js: Red, act today. A buffer overflow vulnerability in the Brotli decoder of Google Brotli versions 1.0.3 through 1.2.0 allows a remote unauthenticated attacker to potentially execute arbitrary code or cause a denial of service.

The flaws

The fix

Fix: Update to the latest available version: 1.0.10 or 1.1.1 or 1.2.1

Who is exposed: {'product': 'Google Brotli', 'packages': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1'], 'versions': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1']}

Where it stands

  • Exploitation reported in the press
  • 1 outlet covering it

How it unfolded

  1. 21 Oct, Node.js security releases (official): Wednesday, October 21, 2026 Security Releases
  2. 23 Oct, The Hacker News (press): Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
  3. 24 Oct, The Hacker News (press): Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Connects to

Why it is Amber

  • CVSS 7.4 high
  • Remotely exploitable without logging in
  • On your watchlist: node.js
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Last activity 23 Oct 2026. Patch Forecast updates every hour.