The releases are Node.js v26.12.1, v24.22.1, and v22.23.4. The project rates the highest-severity issue in each affected line as HIGH.
CVE-2026-111497 is a high-severity out-of-bounds write in the Node.js Brotli decoder. The advisory says the flaw permits remote code execution and affects Node.js 26.x, 24.x, and 22.x. Other high-severity fixes cover NUL-containing names in dns.resolve and two TLS certificate hostname-validation issues. The release also includes medium- and low-severity fixes and dependency updates including c-ares, ca-cert, OpenSSL, SQLite, and Undici.
The source does not describe a public exploit, confirmed exploitation, attack prerequisites, or which application configurations expose the Brotli decoder to untrusted input. It advises using an up-to-date supported version.