October 2026 Node.js vulnerabilities: patch guidance for Azure DevOps and .NET
Node.js released fixes for 10 vulnerabilities on October 21, 2026 in 22.23.4, 24.22.1 and 26.12.1. The Azure DevOps team points out that every layer — agent task runners, pipeline-selected Node.js and container images — has its own update path. The same Brotli memory-corruption flaw (CVE-2026-111497) also affects modern .NET, with fixed runtime baselines 8.0.33, 9.0.22 and 10.0.14.
Key points
- Fixes land in 22.23.4, 24.22.1 and 26.12.1; affected branches and prerequisites differ per CVE
- CVE-2026-111497 in Brotli decompression can corrupt memory and potentially execute code
- Agent v5.281.1 moves Node24 to 24.22.1, but not every platform package ships that runner
- UseNode@1 and NodeTool@0 default checkLatest to false, so 24.x may pick an old patch — verify with node --version
- Modern .NET fixes are 8.0.33, 9.0.22 and 10.0.14; .NET Framework is not affected
- Container images and deployed apps are not fixed by an agent update; they need a rebuild and redeploy
Node.js patched 10 vulnerabilities on October 21, 2026 in 22.23.4, 24.22.1 and 26.12.1. The most serious, CVE-2026-111497, lets malformed attacker-controlled data corrupt memory in the Brotli decoder, with possible code execution. The list also covers DNS name truncation, certificate identity bypasses, unsolicited data on reused keep-alive connections and over-granting wildcard rules in the Permission Model.
Patching one layer is not enough in Azure Pipelines. Agent v5.281.1 brings Node24 to 24.22.1 but ships only on some platforms, and UseNode@1/NodeTool@0 default checkLatest to false, so a 24.x range can still resolve to an old patch. The same CVE is fixed in modern .NET at 8.0.33, 9.0.22 and 10.0.14: update the shared runtime, or rebuild and redeploy self-contained and NativeAOT apps with the patched SDK.
Real-world use
- A team running self-hosted agent pools moving to agent v5.281.1 and confirming the selected Node version in task diagnostics
- An organization using UseNode@1 across repos that wants a pinned Node 24 patch instead of a floating range
- An ASP.NET Core API with request/response Brotli decompression enabled that must move its shared runtime to 8.0.33 or 10.0.14
- A NativeAOT-published service that has to be rebuilt with the patched SDK and runtime packs and redeployed
Why it matters
The same Brotli flaw touches both build pipelines and production .NET services, and patching only one layer leaves you exposed unless agents, task selection, images and app runtimes are each verified.