Threat Intelligence Summary: CVE-2026-105482 & CVE-2026-111497
| Vulnerability Names |
Node.js Allowlist Bypass via Null Byte in Domain Name Truncation (CVE-2026-105482) Node.js Brotli Decoder Code Execution (CVE-2026-111497) |
| Released on | October 23, 2026 |
| Affected Component | Node.js |
| Affected Version |
|
| Vulnerability Type |
Defense bypass Code execution |
| Exploitation Condition |
CVE-2026-105482: The application calls functions in the dns.resolve* family. CVE-2026-111497: The application or one of its dependencies performs Brotli decompression.
|
| Impact |
Exploitation difficulty: easy. An unauthenticated attacker can exploit the vulnerabilities to bypass allowlist protections or execute arbitrary code. Severity: critical. The vulnerabilities may allow attackers to bypass domain allowlists based on string matching or achieve remote code execution. |
| Official Solution | Available |
About the Vulnerability
Component Introduction
Released in May 2009 and developed by Ryan Dahl, Node.js is a JavaScript runtime environment built on Chrome's V8 engine. It uses an event-driven, non-blocking I/O model to enable JavaScript to run on the server side, making JavaScript a scripting language on par with server-side languages such as PHP, Python, Perl, and Ruby.
Vulnerability Description
On October 23, 2026, Sangfor FarSight Labs received notification of the allowlist bypass and code execution vulnerabilities in Node.js (CVE-2026-105482 and CVE-2026-111497), classified as critical in threat level.
CVE-2026-105482 is an allowlist bypass vulnerability in the dns.resolve* family of Node.js functions. When a domain name contains a null byte (NUL, \0), the underlying DNS resolution library silently truncates the name at the null byte. As a result, the string inspected by the application's security checks differs from the domain name actually resolved, thereby enabling an attacker to bypass domain allowlists based on string matching.
CVE-2026-111497 is a code execution vulnerability in the Node.js Brotli decoder, caused by a flaw in its handling of malformed compressed data. Specifically, when the decoder encounters an invalid block switch instruction, it should report an error and abort processing. However, a defective code path fails to handle the error correctly, and allows the decoder to continue running with stale internal state. Under certain conditions, this can ultimately trigger an out-of-bounds write and cause memory corruption.
Affected Versions
The following Node.js versions are affected:
- 22.x < Node.js < 22.23.4
- 24.x < Node.js < 24.22.1
- 26.x < Node.js < 26.12.1
Solutions
Remediation Solutions
Official Solution
Patched versions have been officially released to fix the vulnerabilities. Affected users are advised to promptly upgrade to the corresponding patched version.
Download link: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
Workarounds
- Disable unused functional modules to reduce attack entry points.
- Follow the principle of least privilege to strictly control the scope of permissions for sensitive operations.
- Do not expose services to the Internet unless necessary, to limit the access sources to trusted ranges.
- Regularly update the system and components to secure versions so that known vulnerabilities can be patched at the earliest opportunity.
Sangfor Solutions
Proactive Vulnerability Detection
The following Sangfor service can proactively detect CVE-2026-105482 vulnerabilities and quickly identify vulnerability risks in batches in business scenarios:
- Athena Extended Detection and Response (XDR): The corresponding detection solution will be released on October 30, 2026. The rule ID is SF-2026-13325.
Timeline
On October 23, 2026, Sangfor FarSight Labs received notification of the allowlist bypass and code execution vulnerabilities in Node.js (CVE-2026-105482 and CVE-2026-111497).
On October 23, 2026, Sangfor FarSight Labs released a vulnerability alert.
Reference
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
