October 2026 Node.js vulnerabilities: Azure DevOps security guidance

By /

On October 21, 2026, the Node.js project released fixes for 10 vulnerabilities. These include flaws in DNS resolution and TLS certificate validation, along with a Brotli decompression bug that can corrupt memory and potentially allow code execution when an application processes attacker-controlled data. The fixes shipped in 22.23.4, 24.22.1 and 26.12.1, with different affected branches and prerequisites for each CVE.

Azure Pipelines can use Node.js in several contexts, including agent task runners, pipeline-selected tools and application runtimes. Each has a separate update path.

Vulnerability scope and prerequisites

  • DNS resolution and TLS validation. CVE-2026-105482 can truncate DNS names containing a NUL character after a full-name security check. CVE-2026-105483, CVE-2026-106069 and CVE-2026-106072 involve unusual IP spellings that can bypass certificate identity checks; the required certificate and resolver conditions differ.
  • Brotli decompression. CVE-2026-111497 requires malformed, attacker-controlled data to reach an affected decoder. Memory corruption can cause crashes, disclose memory or potentially allow code execution.
  • HTTP keep-alive response handling. CVE-2026-105481 can make a Node.js HTTP client accept unsolicited data on a reused keep-alive connection as the response to a later request.
  • Startup-snapshot entropy. CVE-2026-106074 can make cached random values repeat across application instances when entropy APIs run during startup-snapshot or snapshot-enabled single executable application creation.
  • Permission Model and ZIP validation. Under the restricted Permission Model, CVE-2026-106073 can expose path information and CVE-2026-106071 can over-grant access for certain wildcard rules. CVE-2026-106070 can return attacker-controlled ZIP content after header validation fails.

The ZIP and wildcard-grant issues list Node.js 26 only; the fullwidth-IP issue (CVE-2026-105483) lists 24 and 26. See the individual advisory sections for affected branches and prerequisites. Installation alone does not establish exposure.

Azure Pipelines remediation guidance

  • Self-hosted agents (Azure DevOps Hosted and Azure DevOps On-Prem). Agent v5.281.1, released October 23, includes the Node24 update to 24.22.1; not every platform package includes this runner. Use the supported agent-pool update process, checking product, OS and architecture compatibility first. For Azure DevOps On-Prem, follow agent support for your release rather than installing this agent release universally. Confirm completion; inspect task diagnostics and verify the selected handler’s binary/version. The release does not establish fleet rollout or fixes for other runner families.
  • Microsoft-hosted agents (Azure DevOps Hosted only). Microsoft maintains agents and images. You still control Node.js installed or selected by your pipeline steps. Verify the actual job image, agent and selected executable rather than assuming patch status from an image label.
  • Pipeline-selected Node.js. UseNode@1 takes version; NodeTool@0 takes versionSpec. Both default checkLatest to false, so a broad range such as 24.x can select an older cached patch. Choose an applicable fixed release or later supported patch in the same major line and keep that selection current. Inside the relevant step, check node --version and node -p "process.execPath". These tasks update PATH, not the agent’s embedded task runners.
  • Tasks and extensions. Publishers should update handlers and dependencies and test compatibility, then publish updated extensions. Consumers should use compatible, supported task versions. A newer runner does not make incompatible task code compatible; do not force every task onto Node24.
  • Containers and deployed applications. Job containers can use agent-provided or image/custom Node.js. Application runtimes need separate servicing. Update affected runtime or image inputs, rebuild and deploy replacements, then verify the running version. Include startup-snapshot and single executable application artifacts where applicable. Host or PATH updates do not rewrite image-bundled runtimes or deployed artifacts.

.NET Brotli remediation

Microsoft’s October 25 .NET security update announcement also covers CVE-2026-111497 in modern .NET. Exposure requires attacker-controlled Brotli reaching an affected decoder through enabled request/response decompression or explicit Brotli APIs. .NET Framework is not affected by this advisory.

Fixed modern-.NET runtime baselines are 8.0.33, 9.0.22 and 10.0.14, with separate preview guidance. For framework-dependent applications, update the shared runtime and restart; rebuild and redeploy self-contained applications. For native ahead-of-time (NativeAOT) applications, use the patched SDK and applicable compiler/runtime packs, then republish and redeploy.

The post October 2026 Node.js vulnerabilities: Azure DevOps security guidance appeared first on Azure DevOps Blog.

Scroll to Top