Node.js October 2026 Security Release: What It Means for MCP Servers and Agent Tools

The Node.js security releases of October 21, 2026, land squarely on AI agent tooling. Node.js 22.23.4, 24.22.1 and 26.12.1 fix ten CVEs. The four High ones are a Brotli decoder out-of-bounds write that can permit remote code execution (CVE-2026-111497), dns.resolve cutting host names at a NUL byte (CVE-2026-105482), and two TLS hostname bypasses for numeric hosts (CVE-2026-106069 and CVE-2026-105483). Most MCP servers, many coding-agent CLIs and plugins, and a lot of agent backends run on Node.js. They spend their day fetching URLs, resolving hosts someone else chose and calling internal services by IP, which are the code paths these bugs live in.

This post maps each bug to agent workloads. For the full list and general upgrade steps, see explainx.ai's Node.js October 2026 security release breakdown. Every CVE also has an entry in the AgentBeam CVE database.

TL;DR

Bug-by-bug: where agents are exposed

Fetch tools and the Brotli bug

A "fetch" or "browse" tool is the most common MCP tool there is. It takes a URL, often chosen by the model from untrusted content, and downloads it. If the HTTP client accepts Content-Encoding: br, the response body goes through the bundled Brotli decoder. CVE-2026-111497 is an out-of-bounds write in that decoder on malformed streams. A prompt injection that gets the agent to fetch an attacker's URL becomes a path for crafted bytes to reach native code in the process that also holds your API keys. No exploit is public, and the advisory gives no detail beyond the fix, but the path is real enough to patch today.

Host allowlists and the DNS NUL bug

Well-built fetch tools check the host against an allowlist before connecting. CVE-2026-105482 breaks checks done on raw strings: dns.resolve truncated a name at an embedded \0, so a value that ends in a trusted suffix in JavaScript could resolve as a different, attacker-chosen name. If your tool validates hosts as strings and then resolves them, upgrade and also reject control characters before the check.

Local model servers, internal services and the TLS bugs

Agent stacks often talk to model servers, vector databases and tool backends by IP address inside a network or a cluster. CVE-2026-106069, CVE-2026-105483 and CVE-2026-106072 all concern numeric hosts in unusual forms (127.1, hex, fullwidth digits). Node.js checked the certificate against one reading of the host while the OS connected to another, or matched DNS names instead of IP entries. With private PKI in the picture, that can turn a verified TLS connection into one an attacker in the network controls. Write IP endpoints in canonical form and restrict which services trust each internal CA.

Single executable agents and repeated "random" IDs

Shipping an agent CLI as a Node.js single executable application (SEA) with a startup snapshot is attractive: one file, fast start. CVE-2026-106074 means that if the snapshot setup code called crypto.randomUUID() or crypto.randomInt(), every copy of the binary replays the same first values. Session IDs, run IDs or temporary tokens can collide across users or be predicted. Upgrading the runtime does not help an SEA you already shipped; rebuild it with the fixed toolchain and rotate anything security-relevant it generated.

The Permission Model is a seatbelt, not a sandbox

Some teams run agent tools under node --permission with --allow-fs-read and --allow-fs-write limits. This release fixes a bypass through fs.realpathSync (all lines) and a wildcard over-grant in the permission tree (26.x). Both are Low severity, and both are a reminder that the Permission Model is meant for trusted code. For tools that execute model-chosen actions, use containers, VMs or a sandbox built for it; we covered one option in Capsem, a VM sandbox for coding agents.

The eMudhra blocklist reaches agent runtimes

The releases also close the gap we described in the eMudhra CA compromise post. Node.js has no CRLSet or OneCRL and no default online revocation, so a chain through a compromised intermediate kept verifying. The new code adds a compiled-in blocklist of the eight eMudhra public key hashes, checked on every verified chain for TLS, QUIC and DTLS, and reported as a revoked certificate. Agent backends and MCP servers on Node.js pick it up only after you upgrade and restart them.

Upgrade checklist for agent stacks

1. Find every Node.js an agent uses. MCP servers launched with npx use the node on the PATH of whatever starts them: your editor, desktop app or agent CLI. Check that environment, not just your terminal.
2. Upgrade with your version manager (nvm install 22.23.4) or system packages.
3. Rebuild Docker-based MCP servers and agent images from node:22.23.4, node:24.22.1 or node:26.12.1 with --pull.
4. Rebuild SEAs and snapshot blobs, then rotate tokens they generated.
5. Restart long-running agent services and MCP hosts so child processes start on the new binary.
6. Check Electron-based agent apps; they embed their own Node.js and need a vendor update.
7. Do not "fix" new certificate errors by disabling verification. If a tool starts failing TLS after the upgrade, it may have been talking to something it should not.

Where Beam fits

Beam does not patch runtimes. It records the shell commands, file access and MCP tool calls that coding agents such as Claude Code and Codex make on your machine, redacts recognized secrets, and flags risky patterns. That helps with two parts of this release: seeing which MCP servers and tools your agents actually launch, and catching an agent that "fixes" a TLS error by setting NODE_TLS_REJECT_UNAUTHORIZED=0 or rejectUnauthorized: false during an upgrade. See MCP server security review for how to audit the servers you run.

Update (October 23, 2026): Semgrep maps how apps reach the Brotli bug ("Node2Shell")

Semgrep's write-up of the Brotli bug, published October 22 under the name Node2Shell, adds the exposure detail this post lacked. The flaw is an improper bounds check in the reference Brotli decoder that produces an out-of-bounds write. Semgrep explains that the decoder could confuse incomplete input with invalid input and keep processing a malformed stream; the upstream fix, listed in the Brotli 1.2.1 changelog as CVE-2026-111497, adds separate error states and stops at an invalid block transition. It is not a bug in an npm package called brotli or in body-parser itself.

Reaching it depends on the application. Semgrep lists these confirmed entry points, and says the list is not exhaustive:

• Express 5 with body-parser 2.x and inflation enabled: a Content-Encoding: br request body can reach the decoder before JSON parsing (Express 4 lacks the same default Brotli path).
• Node's built-in fetch(), when the application retrieves an attacker-controlled or attacker-influenced response. This is the path most relevant to agent tools that browse.
• Direct node:zlib use such as createBrotliDecompress() on attacker-controlled data.
• Koa through co-body and inflation, which Semgrep says also covers @koa/bodyparser, koa-body, Egg and Strapi, and Fastify with @fastify/compress, plus ultimate-express.

Semgrep also notes that anything bundling the same Brotli implementation may be affected under certain conditions. Semgrep says its list will grow as exposure is verified. What to do: upgrade to 22.23.4, 24.22.1 or 26.12.1 as above, and for MCP servers and agent backends that are Express, Koa or Fastify apps, check whether a Brotli-capable parser is mounted on public routes.

Update (October 24, 2026): the Brotli bug was reported by OpenAI Codex Security

The Node.js October 2026 security release notes credit CVE-2026-111497 to "OpenAI Codex Security (Khai Tran)" and Sylvie Mayer, with fixes by mcollina and aduh95. The advisory describes the root cause as an invalid block switch reported as a temporary need for more input rather than a permanent format error, so the streaming decoder kept appending input bytes to an internal buffer of only eight bytes. The notes name three possible outcomes: a crash, disclosure of process memory, or remote code execution. They list exposure as any application that decompresses untrusted Brotli input with node:zlib.

Two things have not changed. The Node.js notes publish no workaround for the Brotli issue, so upgrading to 22.23.4, 24.22.1 or 26.12.1 remains the fix, and Docker images and single executable binaries must be rebuilt. We found no report of exploitation in the wild in the sources we checked.

What people ask

"The release says no exploitation. Why rush?"

Because agent tools put the vulnerable paths in front of untrusted input by design. A model that reads a malicious page can be steered to fetch a URL; that is all the Brotli path needs.

"Our MCP server is written in Python. Are we fine?"

For these CVEs, yes. Python has its own equivalents to watch, such as certifi for the eMudhra keys.

"We pinned Node 20 for an old MCP server."

Node.js 20 is end of life and is affected without a fix. Move the server to 22 or 24.

Related reading

• MCP TypeScript SDK: four advisories in SDK 1.32.0
• eMudhra CA keys compromised: what to update
• PHP2Shell and AI agents: why the attack window just collapsed
• npm supply chain worms and AI tooling
• Brotli CVE-2026-111497: Python, Bun, Envoy, curl fixes
• Node.js October 2026 security release breakdown on explainx.ai

Primary sources: Node.js October 2026 security releases · v22.23.4 · v24.22.1 · v26.12.1

Details are accurate as of October 21, 2026. The Node.js advisory lists titles and affected lines; mechanism details come from the public fix commits.