CVE-2026-105481, CVE-2026-105483, CVE-2026-106069 +6 more CVEs: node 22.23.3 through 22.23.3, 24.22.0 through 24.22.0, 26.12.0 through 26.12.0, 24.22.0…

CVE-2026-105481

Affected technology

node · 22.23.3 through 22.23.3, 24.22.0 through 24.22.0, 26.12.0 through 26.12.0
nodejs

Description’s affected range: before the client

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.0 assessment (base score 6.5/10) rates confidentiality impact as low; integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-105483

Affected technology

node · 24.22.0 through 24.22.0, 26.12.0 through 26.12.0
nodejs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.0 assessment (base score 7.4/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-106069

Affected technology

node · 22.23.3 through 22.23.3, 24.22.0 through 24.22.0, 26.12.0 through 26.12.0
nodejs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.0 assessment (base score 7.4/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-106070

Affected technology

node · 26.12.0 through 26.12.0
nodejs

Component: Not specified by the source
File: instead

Attack conditions (Vendor/CNA, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.0 assessment (base score 3.7/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-106071

Affected technology

node · 26.12.0 through 26.12.0
nodejs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Local · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.0 assessment (base score 3.6/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-106072

Affected technology

node · 22.23.3 through 22.23.3, 24.22.0 through 24.22.0, 26.12.0 through 26.12.0
nodejs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.0 assessment (base score 6.7/10) rates confidentiality and integrity impact as high; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-106073

Affected technology

node · 22.23.3 through 22.23.3, 24.22.0 through 24.22.0, 26.12.0 through 26.12.0
nodejs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Local · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.0 assessment (base score 3.3/10) rates confidentiality impact as low; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-106074

Affected technology

node · 22.23.3 through 22.23.3, 24.22.0 through 24.22.0, 26.12.0 through 26.12.0
nodejs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.0 assessment (base score 4.8/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-111497

Affected technology

Brotli · 1.0.3 to before 1.0.10, 1.1.0 to before 1.1.1, 1.2.0 to before 1.2.1
Google

Description’s affected range: versions 1.0.3 through 1.2.0 on all platforms

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A remote unauthenticated attacker can corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Vendor/CNA’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality, integrity and availability impact as high.