Node.js and GitLab Ship Critical Fixes; OpenAI’s Codex Security Found One

Two of the most widely used developer platforms shipped critical patches on the same day.

Node.js released 22.23.4, 24.22.1 and 26.12.1 on October 21. The headline fix, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that permits remote code execution. Node credits OpenAI’s Codex Security, with Khai Tran and Sylvie Mayer. Two more fixes close ways to bypass TLS hostname checks, and the releases update certificates to NSS 3.131.1, which removes the eMudhra root.

Vercel says its firewall rules for the Node flaw are live for customers.

GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 to fix CVE-2026-110264. It is an unauthenticated remote code execution flaw rated CVSS 10.0, caused by an integer overflow in the regular expression compiler. Every version since 7.0 is affected, GitLab says, and GitLab.com is already patched. It was reported through HackerOne by joaxcar.

@levelsio points to the Node fix as proof that AI-assisted vulnerability hunting will reach “any language, any framework, any server software,” far beyond PHP.