The Node.js project has released critical security updates for the 26.x, 24.x, and 22.x versions. These patches address more than 10 vulnerabilities, including four classified as high-severity risks.
The high-severity issues include a Brotli decoder vulnerability that allows for remote code execution, and three flaws related to TLS certificate hostname verification bypasses. These vulnerabilities affect various combinations of the 26.x, 24.x, and 22.x release lines.
Additional medium-severity vulnerabilities involve improper handling of Keep-alive sockets, incorrect certificate validation for non-canonical IPv4 hostnames, and issues with entropy caching in crypto functions. These flaws could lead to predictable random values in processes.
Low-severity bugs were also addressed, including issues with ZIP file header validation, excessive filesystem permissions in the permission model, and a bypass vulnerability in fs.realpathSync. The updates are available in versions v22.23.4, v24.22.1, and v26.12.1.
