Home / Blog / General / Update on Node.js vulnerabilities CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069

Update on Node.js vulnerabilities CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069

Published: October 30, 2026 | Last updated: October 30, 2026

Overview

On October 21, 2026, Node.js announced security releases for the 26.x, 24.x and 22.x release lines to fix multiple vulnerabilities. These affect critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation, and carry risks of remote code execution (RCE) and traffic interception.

This update covers the following four vulnerabilities: CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069.

Vulnerability details

CVE	Severity	Type	Affected lines	Fixed in
CVE-2026-111497	High	Brotli decoder out-of-bounds write; potential remote code execution (RCE)	26.x, 24.x, 22.x	v26.12.1, v24.22.1, v22.23.4
CVE-2026-105482	High	DNS resolution truncation involving embedded NUL characters	26.x, 24.x, 22.x	v26.12.1, v24.22.1, v22.23.4
CVE-2026-105483	High	TLS hostname validation bypass using fullwidth IP digits	26.x, 24.x	v26.12.1, v24.22.1
CVE-2026-106069	High	TLS hostname validation bypass with non-canonical IP addresses	26.x, 24.x, 22.x	v26.12.1, v24.22.1, v22.23.4

Our evaluation

After the disclosure, our security teams reviewed the ManageEngine products and supporting infrastructure.

Findings:

Internal build service: The affected Node.js version was used in an internal service for build generation. It is not used at runtime, and it does not process customer traffic or data.
Network exposure: The internal service is not exposed to the internet.
Remediation: As a precaution, we have upgraded the Node.js version used in our build process to a patched version.

Customer impact and required action

No impact on customer data or on the functionality of ManageEngine products has been identified, and no action is required on the part of our customers. We have found no evidence of exploitation in our environment.

ManageEngine continuously monitors security advisories and evaluates potential vulnerabilities in order to safeguard the security of its services and the integrity of customer data. We will promptly notify you of any relevant findings or changes.