On October 21, 2026, the Node.js project published security releases for the 22.x, 24.x and 26.x lines. They fix ten vulnerabilities, four of them rated high, including an issue in Brotli decompression. The news is also interesting because AI-assisted security research helped uncover a flaw in technology used by applications around the world.
We reviewed every issue against Total.js 4 and Total.js 5. This post explains what happened, what we changed in both frameworks, and what we recommend you do.
Node.js fixed these issues in the release (full details in the official advisory):
| Severity | Component | What can go wrong |
|---|---|---|
| High | Brotli decoder (node:zlib) | Specially crafted compressed input can cause an out-of-bounds write. Depending on how an application processes untrusted data, the impact ranges from a crash to memory disclosure. |
| High | DNS (dns.resolve*()) | A hostname containing a NUL byte is truncated, so a name that passed validation can resolve to a different one. |
| High / Medium | TLS (tls.checkServerIdentity()) | IPv4 addresses written in unusual ways (non-ASCII digits, leading zeros, 0x7f.0.0.1, 127.1) can be interpreted differently by the certificate check and by the operating system. |
| Medium | HTTP keep-alive agent | An unsolicited response waiting on a reused socket can be accepted as the answer to the next request. |
| Medium / Low | Snapshots, permission model, ZIP reading | Specific features that most applications do not use. |
The Brotli flaw was reported by OpenAI's Codex Security, an AI-assisted tool, together with two security researchers, and fixed by Node.js maintainers. It is a good reminder of how AI-assisted tools are changing security research: they can help investigators find suspicious behavior in complex code, while human researchers validate the findings and work with maintainers on fixes.
These are Node.js runtime issues, not vulnerabilities in the Total.js architecture. Total.js does not depend on a specific Node.js version, and we want to keep it that way: your applications run on the Node.js you choose, so you decide when to update it.
What we can do is make the framework safe by itself, whatever Node.js version you run. We went through the code and covered every case that depends on us:
gzip and deflate, so the framework itself is not exposed. If your own application decompresses Brotli data with node:zlib, update Node.js.Both frameworks now normalize and validate hostnames before they reach DNS or a TLS connection:
127.1 and 0x7f.0.0.1 become 127.0.0.1), so the certificate check and the operating system see the same address.Invalid hostname error instead of reaching the network.Where it applies:
REQUEST(), U.resolve() and HTTP redirects (a server can no longer send a request to an unusual address through a Location header).U.connect(), which is also used by LDAP().U.validhost(host) and U.tohost(host).Your existing configuration keeps working. Normal hostnames, normal IP addresses, IPv6 and punycode names behave exactly as before. We also did not raise the minimum Node.js version: the changes were tested with the full test suite of each framework on Node.js 14, 16, 18, 19, 20, 22, 24 and 26.
These changes are included in the latest update of each framework and described in its changelog.
You are covered even if you cannot update Node.js right away. The hostname issues (DNS and TLS) are handled by the framework itself, so Total.js 4 and Total.js 5 protect your application against them on the Node.js version you already run. We still recommend updating Node.js: it also fixes the rest of the release, such as the keep-alive issue, which only the runtime can address.
1. Update your Node.js runtime to a security-patched release. The corrected versions are:
If you use Docker, update and rebuild your application image: updating the host alone does not update Node.js inside a container, and tags such as lts or 24 only change when you pull and rebuild. Restart your applications after deploying the patched runtime and verify the active version with node --version.
2. Update Total.js. Take the latest release of Total.js 4 or Total.js 5 and check the Total.js GitHub for new versions of the applications you use. Our apps and packages are being updated to the new framework releases, so it is worth reviewing the repositories of the ones you run and updating them.
3. Review your own code. If your application decompresses Brotli data, resolves or connects to hostnames that come from users, or uses Node.js snapshots or the permission model, treat the Node.js update as a priority.
This incident illustrates both the value of modern security research and the importance of timely updates. We will continue to follow upstream Node.js security advisories and act where the framework can help.
Our recommendation to the Total.js community is simple: update Node.js to a corrected release, update Total.js, and check GitHub for new versions of your applications.