Node.js Security Updates: Patch Azure Pipelines and .NET for Brotli RCE

Node.js 22.23.4, 24.22.1 and 26.12.1 fix 10 CVEs, including a Brotli remote code execution bug. Microsoft's Azure DevOps Blog (Josef Sin) published guidance on November 5. Its main point is that Azure Pipelines can run Node.js as an agent task runner, as a pipeline-selected tool, or as an application runtime. Each has its own update path. Patching one does not patch the others.

What was fixed, and when it matters​

The Node.js advisory shows that exposure depends on how an application uses Node.js. Installing a vulnerable version does not by itself mean you are exploitable.

High severity

• CVE-2026-111497 (Brotli decoder). Malformed compressed input can write past the end of an internal decoder buffer. An attacker has to be able to supply Brotli data that the application decompresses with node:zlib. The result can be a crash, disclosure of process memory, or remote code execution. It affects the 22.x, 24.x and 26.x lines.
• CVE-2026-105482 (DNS). dns.resolve*() and dns.reverse() silently truncate hostnames that contain a NUL byte. Resolving attacker.example\0.trusted.example therefore queries attacker.example. An app that checks the full name against an allowlist and then resolves it could act on records for a different name. It affects 22.x, 24.x and 26.x. It is an incomplete fix of an earlier CVE.
• CVE-2026-105483 (TLS, fullwidth digits). An IP written with fullwidth digits, such as １２７.0.0.1, was not recognized as an IP address. A certificate with a matching DNS name, like DNS:127.0.0.1, could then authenticate an IP endpoint it was never issued for. It affects 24.x and 26.x only.
• CVE-2026-106069 (TLS, leading-zero IPv4). 0127.0.0.1 is read as octal by the URL rules (87.0.0.1), but some platform resolvers, macOS for example, read it as decimal (127.0.0.1). The certificate check and the actual connection can then disagree about the address. It affects 22.x, 24.x and 26.x.

Medium severity

• CVE-2026-106072. Other odd IPv4 spellings (0x7f.0.0.1, 2130706433, 127.1) can slip past the IP classification. Exploitation needs a trusted certificate with a numeric DNS SAN and a resolver that accepts the spelling, such as glibc.
• CVE-2026-105481. A reused HTTP keep-alive connection can accept unsolicited data as the response to a later request. This happens when the data has arrived but not been read, for example because the event loop was busy with synchronous work.
• CVE-2026-106074. Random-value caches can be baked into startup snapshots and snapshot-enabled single executable applications. Every process started from the artifact then repeats the same values: up to 127 UUIDs and about 1,000 randomInt() values.

Low severity

• CVE-2026-106070. A ZIP header-validation failure in zlib.ZipFile can leave state cached, so a later read returns attacker-controlled bytes. Node.js 26.x only.
• CVE-2026-106071. A Permission Model wildcard grant can allow a shorter path than intended. For example, --allow-fs-read=/etc/passwd.* also allows /etc/passwd. Node.js 26.x only.
• CVE-2026-106073. fs.realpathSync() skips the read-permission checks under --permission. This is an incomplete fix of an earlier CVE.

The 24.22.1 release notes also list dependency updates: c-ares, OpenSSL 3.5.9, Undici, timezone data and root certificates.

Real-world urgency​

Outside reporting suggests the Brotli bug deserves priority. Konfirmity's advisory page says Imperva ran code on the official Node.js 24.22.0 image through both a Brotli response read by the built-in fetch and a Brotli request body handled by Express and body-parser. It also says CISA added the Brotli flaw, CVE-2026-111497, to KEV on 27 October. I could not check either claim against the primary source, so treat them as attributed to that page.

Teramont, a hosting blog, reports a local test on Linux x64. In it, 127.1 with a DNS:127.0.0.1 certificate was accepted by 24.22.0 but rejected by 24.22.1 with ERR_TLS_CERT_ALTNAME_INVALID. That matches the advisory's description of the fix.

Not every line gets a patch. The Node.js advisory says end-of-life versions are always affected when a security release occurs. Per Konfirmity, Node 20 and older, and Node 25, 23 and 21, have no fix. Those versions need a move to 22, 24 or 26.

Azure Pipelines: one patch per copy of Node.js​

Self-hosted agents​

Agent v5.281.1 (released October 23) updates its Node 24 runner to 24.22.1, according to the agent's release notes. Not every platform package includes this runner. Before updating:

1. Check your agent's OS against what the 5.x agent supports. Microsoft Learn says 5.x agents run on .NET 10 and that automatic upgrades do not check OS support. On an unsupported OS, the upgrade can fail or the agent may not start.
2. Use the supported agent-pool update process.
3. Confirm the update finished, then check task diagnostics for the binary and version the handler actually uses.

Azure DevOps Server (On-Prem) caveat. Microsoft Learn says Server 2020 and later support the 5.x agent through updates, and that the latest Server release uses the 4.x agent. One reader comment on the blog says Azure DevOps Server 2022 and 25H2 are not compatible with v5 agents. The commenter asks whether a patched v4 agent will follow. Microsoft's FAQ says previous agent versions generally get no patches, but the team reviews security issues case by case. Do not assume v5.281.1 is the answer for On-Prem. Follow the agent guidance for your specific release.

Microsoft-hosted agents​

Microsoft maintains the agents and images. You still control any Node.js your pipeline installs or selects. Verify the actual agent, image and executable in a job rather than trusting an image label.

Pipeline-selected Node.js​

UseNode@1 takes version. NodeTool@0 takes versionSpec. Microsoft's UseNode@1 documentation shows checkLatest defaulting to false. A broad range such as 24.x can therefore resolve to an older cached patch.

In practice:

• Pin a fixed patch (22.23.4, 24.22.1 or 26.12.1) or a later supported patch in the same major line.
• Inside the relevant step, run node --version and node -p "process.execPath". The second command shows which binary is actually running.
• Remember that these tasks change PATH. They do not touch the Node.js runners embedded in the agent.

Tasks, extensions, containers and deployed apps​

• Task publishers. Update handlers and dependencies, test, and publish new extension versions.
• Task consumers. Use compatible, supported task versions. Microsoft's runner documentation warns that a newer runner does not make older task code compatible. Do not force every task onto Node 24.
• Containers and applications. A host PATH change does not rewrite an image-bundled runtime or a deployed artifact. Update the runtime or image input, rebuild, redeploy, then verify the running version. This includes snapshot-built artifacts and snapshot-enabled single executable applications. Rebuild those, because the entropy issue is baked into the artifact.

Related timing: Microsoft Learn says Node 6, 10 and 16 runners will be removed from the agent on November 24, 2026. If you are auditing task handlers, check for those at the same time.

The .NET angle​

CVE-2026-111497 also affects modern .NET, through a separate remediation path. Microsoft's October 25 .NET out-of-band announcement says the flaw is a buffer overflow in .NET's use of Brotli. Apps are exposed through ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs. Request and automatic response decompression are not on by default. .NET Framework is not affected.

Fixed versions:

Remediation depends on how the app is deployed:

• Framework-dependent apps: install the updated runtime and restart the app.
• Self-contained apps: rebuild and republish. A newer host runtime does not update the bundled one.
• Containers: rebuild and redeploy on updated images.
• Native AOT apps: Microsoft's guidance is to use the patched SDK and applicable compiler and runtime packs, then republish.

You can list installed runtimes with dotnet --list-runtimes. That only covers the host, not self-contained apps or containers.

Practical checklist​

1. Inventory every Node.js copy: agent runners, UseNode@1 and NodeTool@0 steps, job containers, deployed apps and snapshot artifacts.
2. Prioritize anything that decompresses untrusted Brotli data, such as web servers, API gateways and fetch clients.
3. Pin fixed versions rather than relying on 24.x.
4. Update self-hosted agents, checking OS and Azure DevOps Server compatibility first.
5. Verify in a running job and in running production services, not only on a build machine.
6. Replace end-of-life Node.js lines.

Bottom line​

This is a patch-management problem more than a single-update problem. The agent update is available, but the release does not show that your fleet, hosted images or other runner families have been updated. The Brotli bug has a plausible path to remote code execution where untrusted compressed data reaches the decoder. The TLS and DNS bugs mostly matter to apps that validate identities and then connect or resolve separately. The practical lesson is to find out which Node.js binary each job and service actually runs.