Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

Source: Qualys Security Blog

Author: Bhagyashree Thorat

URL: https://blog.qualys.com/product-tech/2026/10/27/cant-patch-node-js-yet-build-a-stopgap-with-the-controls-you-own

ONE SENTENCE SUMMARY:

Node.js patched critical Brotli RCE and DNS/TLS flaws; use discovery, mitigations, layered controls, then upgrade, restart, rebuild, and verify.

MAIN POINTS:

1. October 21 Node.js release fixed 10 vulnerabilities, including Brotli RCE CVE-2026-111497.
2. Patched versions are Node.js 22.23.4, 24.22.1, and 26.12.1.
3. Qualys telemetry shows only 42,000 of ~3.3 million installations patched so far.
4. About 1.7 million installations run end-of-life Node.js lines that will never be fixed.
5. Runtime-embedded Node.js in containers, single executables, and serverless evades dependency checks.
6. Prioritize internet-facing services decompressing untrusted Brotli; then user-supplied TLS host connections.
7. Interim mitigations include limiting Brotli decompression size/ratio at proxies or WAF.
8. DNS hardening uses dns.lookup, rejects NUL hostnames, and canonicalizes IPs before TLS.
9. Additional risk reduction disables keep-alive to untrusted servers and treats Permission Model as advisory.
10. Defense-in-depth adds WAF/IPS signatures and EDR behavior/exploit protections, but upgrading is essential.

TAKEAWAYS:

1. Migrating off unsupported Node.js branches is mandatory because no patches will arrive.
2. Inventory must capture hidden runtimes across hosts, containers, and application-bundled binaries.
3. Compensating controls reduce exposure windows, especially for Brotli-based inbound exploit attempts.
4. Remediation requires rebuild/redeploy and service restarts, not just package installation.
5. Verification closes the loop: rescan to confirm QIDs resolved and controls correctly applied.