Today is apparently patch Wednesday for the web stack. Node.js ships security releases for all three active lines (v22.23.4, v24.22.1, v26.12.1) with 10 CVEs, and PHP is right behind with two CVSS 9.2 patches dropping at 14:00 UTC, details still embargoed.
The Node.js bug worth reading first is CVE-2026-111497: an out-of-bounds write in the bundled Brotli decoder. Malformed Brotli-compressed input, crash at minimum, code execution under the right memory layout. It hits all three active release lines. Decompressor CVEs have a history of being more exploitable than their initial advisories suggest, for the same reason heap corruptions in parsers always look “theoretical” until they aren’t. This is the one to patch before coffee.
CVE-2026-105483 and CVE-2026-106069 are two separate TLS hostname bypass bugs. The first involves fullwidth Unicode digits (U+FF10 through U+FF19) in IP address strings; the comparison logic doesn’t normalize them, so a certificate for a different host passes verification. The second is a looser variant where a hostname that resolves to an IP address bypasses the check via a different code path. Two bugs, same root cause: hostname comparison is harder than it looks and Node.js found two more ways to get it wrong. This class of Unicode normalization failure has been documented in TLS libraries since at least 2009. The OpenSSH host-key reexchange CVE from earlier this month was a different failure mode in the same general territory: crypto and auth code that looks correct until someone asks “but what about this input?”
CVE-2026-105482 is dns.resolve truncating names at NUL characters. Someone passed a hostname with an embedded NUL byte; Node.js silently truncated it and resolved a different name. NUL injection in DNS is not new. It is not subtle. It is the same bug that showed up in OpenSSL in 2009 and in dozens of string-handling libraries before and after. The year is 2026 and we are still finding it in new places.
Node.js also patched crypto.randomUUID() entropy caches leaking into startup snapshots (CVE-2026-106074), a keep-alive socket processing stale responses (CVE-2026-105481), and a handful of Permission Model bypasses that only affect the experimental sandbox (26.x). The full table is in the advisory linked below. Dependency bumps in this release include c-ares, OpenSSL (on 22.x and 24.x), and Undici.
On the PHP side: two RCEs running through multipart upload handling, both scored CVSS 9.2. Technical details are still under embargo until 14:00 UTC. What you know is enough: two critical RCEs in the thing that handles file uploads on roughly a third of the web. The CVE scoring inflation problem is real, but CVSS 9.2 on a multipart RCE is not one of those cases. Pull the update now, read the post-mortem tonight.
If you are running either runtime in production, both patches are out today. Pick your preferred ritual for “npm is a nightmare and I hate updating things” and get on with it.