Fortinet put FortiOS under investigation on October 26 after the Node.js project fixed ten vulnerabilities across its supported release lines. One of them, a Brotli decoder out-of-bounds write, can corrupt a Node.js process when an application decompresses attacker-supplied data. For teams running Node.js services, the project’s security releases provide fixed builds now. Fortinet’s PSIRT advisory lists FortiOS as under investigation, rather than confirmed affected.

Fortinet says, “Fortinet is currently investigating the impact of these CVEs over Fortinet Products.” It lists FortiManager, FortiAnalyzer, FortiWeb and a longer set of products as confirmed unaffected. Update your Node.js deployments to a patched release, and watch Fortinet’s FortiOS advisory for a product-specific finding. Fortinet says known exploitation of the issues in its advisory is “No.”

Compressed input overruns the decoder

The highest-impact path in the Node.js release is CVE-2026-111497. The project says an invalid Brotli block switch was treated as a temporary request for more input, so the streaming decoder continued adding bytes to an eight-byte internal buffer. An application that passes attacker-controlled Brotli input to node:zlib can then suffer a process crash, memory disclosure or remote code execution. Scope the exposure check to services where remote Brotli data reaches node:zlib. The CVE Program record names Google Brotli as the affected component and credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer; the Node.js project credits them too.

The other fixes address different paths. CVE-2026-105482 lets dns.resolve*() and dns.reverse() truncate a hostname at a NUL byte, so an application that validates a complete name before resolution can resolve a different one. The Node.js project describes it as an incomplete fix of CVE-2026-48930, which covered dns.lookup() and network host options. CVE-2026-105483, CVE-2026-106069 and CVE-2026-106072 involve TLS identity checks on unusual IPv4 spellings. The Node.js release also fixes unsolicited responses on reused HTTP sockets (CVE-2026-105481), repeated entropy-cache values in startup snapshots and snapshot-enabled single executable applications (CVE-2026-106074), a ZIP header validation error (CVE-2026-106070), and two Permission Model filesystem issues (CVE-2026-106071 and CVE-2026-106073). Check exposure by API and input path for each failure mode; upgrading the affected Node.js line covers the release.

Release builds and product scope

Node.js lists first fixed versions 22.23.4, 24.22.1 and 26.12.1. Its October 21 release also updates c-ares, ca-cert, Undici and other branch-specific dependencies. CVE-2026-105483 affects the 24.x and 26.x lines; CVE-2026-106070 and CVE-2026-106071 affect 26.x. The remaining listed CVEs affect all three lines. The project says end-of-life Node.js versions are affected when a security release occurs; move those services onto a maintained, patched line.

Fortinet’s advisory carries a Critical severity, an unauthenticated attack type and a 9.8 CVSSv3 score in its metadata for CVE-2026-106069. Node.js rates the highest issue in each patched release line High. Fortinet marks Virtual Patch “No”; use its next product-specific finding to decide whether an appliance update is required.

Compare installed Node.js builds

Find the deployed Node.js version in services that run the 22.x, 24.x or 26.x lines, including packaged application images, and replace older builds with 22.23.4, 24.22.1 or 26.12.1 or a later maintained release in the same line. Prioritize services that decompress data supplied by remote clients with node:zlib; the release fixes the other listed flaws too, so the version check applies across these supported lines. After rollout, verify that the running process reports the patched Node.js build you deployed, even when the base image or dependency declaration names a patched version.

For Fortinet estates, keep FortiOS on the investigation list and consult FG-IR-26-187 for the next product-specific update. Record the installed FortiOS build separately from the Node.js inventory. Fortinet’s confirmed-unaffected product list helps remove those named products from this particular investigation. Updating a Node.js application addresses its own decoder and related runtime flaws while Fortinet works through the appliance question.