Node.js October 2026 security vulnerabilities (CVE-2026-111497)

A vulnerability in Node.js, the runtime that Retool runs on, can allow remote code execution. An out-of-bounds write in the Node.js Brotli decoder can be triggered by a crafted, Brotli-compressed HTTP response. Many of the HTTP clients that Retool uses decompress Brotli responses automatically. An attacker who can make a Retool instance send an HTTP request to a server they control, such as through a REST API resource, could use this to run code on that instance.

Retool Cloud was patched on October 21, 2026, at 4:44 PM PDT, 13 hours and 6 minutes after public disclosure. No action is required for Cloud customers. Self-hosted customers should upgrade to a fixed version.

The same Node.js release fixes other vulnerabilities that have a lower impact on Retool. Upgrading to a fixed version addresses all of them. For details on each one, refer to Vulnerabilities in this release.

We have no indications of malicious activity using this vulnerability against Retool. The vulnerability was disclosed publicly by the Node.js project on October 21, 2026, at 3:38 AM PDT, as part of its October 2026 security releases.

We will communicate further updates here, should such become necessary.

Disclosure	Details
Vulnerability Type	CWE-787: Out-of-bounds Write
Package	Node.js, and the system Brotli libraries shipped in Retool images
Fixed Version	Node.js 22.23.4. Retool: Edge 4.81.0+, Stable 4.34.12+, 4.0.25+, 3.334.32+
Affected Component	MAIN_BACKEND and DB_CONNECTOR services, through HTTP responses from user-configured URLs
Attack Type	Remote
Impact	Remote code execution
CVSS 3.x Base Score	8.5
CVSS 3.x Vector	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 4.x Base Score	9.0
CVSS 4.x Vector	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Reference	https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

The CVSS scores above are specific to Retool. They reflect how an attacker reaches this vulnerability through Retool, which in most cases requires a user with permission to create or edit resources or queries that send requests to URLs they choose. NVD hasn't scored CVE-2026-111497 at the time of writing. Google, the CVE Numbering Authority for this vulnerability, scored the underlying Node.js issue 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

Am I affected?

Retool Cloud has been patched, and Cloud customers don't need to take any action.

Self-hosted instances running a version earlier than the fixed versions are affected. To exploit this vulnerability, an attacker needs to make your instance send an HTTP request to a server they control and receive its response. Retool sends HTTP requests to user-configured URLs in several places, including:

• REST API, GraphQL, OpenAPI, and MCP resources.
• OAuth 2.0 authentication, which sends token requests to the access token URL configured on a resource.
• Custom AI providers configured with a custom base URL.

This is possible for:

• Users with permission to create or edit these resources or AI providers, or to edit apps or workflows that contain their queries.
• Anyone who controls, or has compromised, a server that one of these resources already sends requests to.
• App users who can supply a request URL, if an app builds request URLs from user input.
• Anyone who can intercept and modify unencrypted HTTP traffic between your instance and a server.

Integrations that only connect to a fixed vendor endpoint, such as Stripe or Google Sheets, are lower risk. Exploiting them would require compromising the vendor or intercepting encrypted HTTPS traffic.

Retool images also ship a separate system Brotli library that curl and git use. Refer to System Brotli libraries for that narrower path.

What are the mitigations or remediations?

The only complete fix is to upgrade your instance to a fixed version.

Until you can upgrade, mitigate your exposure by doing the following:

• Review which users can create or edit resources, AI providers, apps, and workflows, and limit these permissions to users who need them.
• Review your resources and queries for request URLs and OAuth 2.0 access token URLs on hosts you don't recognize.
• Use HTTPS for resources that send HTTP requests so that responses can't be modified in transit.
• Review which Source Control remotes your instance connects to, and prefer HTTPS remotes you control.

What is the impact?

An attacker who exploits this vulnerability can run code in the Retool service that received the malicious response. This is the DB_CONNECTOR service for resource queries, and the MAIN_BACKEND service for OAuth 2.0 token requests and custom AI providers. From there, they could access the resource credentials and query data that pass through the service, and reach any internal systems that the service has network access to.

MAIN_BACKEND runs in the api container. By default, DB_CONNECTOR also runs inside the api and workflows-backend containers, as described in System architecture. Code running in these containers has access to everything they can access, including your encryption key and the Retool database.

System Brotli libraries

Retool images also ship a system Brotli library that is separate from the decoder bundled in Node.js:

• On Debian-based images, this is the Debian libbrotli1 package, pulled in because git and curl depend on libcurl.
• On hardened Chainguard/Wolfi images, this is libbrotlidec and related packages.

Git uses that library when it fetches over HTTP. An attacker who can make your instance's git client fetch from a server they control, and who returns a crafted Brotli-compressed response, could trigger the vulnerability in the system library. Source Control clone and fetch operations use this path when they talk to an HTTP or HTTPS remote.

This path is narrower than the Node.js path described above. It isn't reachable through a REST API resource query. It requires control of, or a compromise of, a Git remote that Source Control connects to, or the ability to intercept that Git traffic. Upgrading to a fixed version updates both the Node.js runtime and the system Brotli libraries.

What are indicators of compromise (IOCs)?

A failed attempt to exploit this vulnerability is likely to crash the process. A successful attempt can lead to activity that Retool services don't normally perform. Check the api and workflows-backend containers, and any separate DB_CONNECTOR containers, for:

• Unexpected crashes or restarts, especially processes that end with a SIGSEGV signal.
• Unexpected processes started inside those containers.
• Outbound connections to internal systems those containers don't normally contact, such as your cloud provider's metadata service.

Also check for resources or queries that point to unfamiliar hosts, including OAuth 2.0 access token URLs, and for recent changes to them in your audit logs. For the system Brotli path, also check Source Control remotes and recent git clone or fetch activity.

Vulnerabilities in this release

The Node.js October 2026 security release fixes the following vulnerabilities in Node.js 22, the version Retool uses. The severity is the rating from the Node.js project. The impact describes Retool's assessment of how each vulnerability affects Retool.

CVE	Node.js severity	Impact on Retool
CVE-2026-111497	High	Remote code execution
CVE-2026-106069	High	Affected, requires network interception
CVE-2026-106072	Medium	Affected, requires network interception
CVE-2026-105482	High	Not exploitable in Retool, based on our assessment
CVE-2026-105481	Medium	Low
CVE-2026-106073	Low	Low
CVE-2026-106074	Medium	Not affected

The sections above describe CVE-2026-111497 in detail. The release also updates the versions of c-ares, OpenSSL, SQLite, undici, and the root certificates bundled with Node.js.

CVE-2026-106069 and CVE-2026-106072: TLS certificate hostname validation

In some cases, Node.js could accept a TLS certificate that doesn't match the host it connects to. CVE-2026-106069 applies when a hostname loosely resolves to an IP address. CVE-2026-106072 applies when a host is an IPv4 address written in a non-canonical form, such as 127.1 or 0x7f.0.0.1, which lets a certificate issued for a DNS name authenticate an IP address.

Retool relies on Node.js to validate certificates when it connects to resources over HTTPS or TLS. An attacker who can intercept traffic between Retool and a resource could use these vulnerabilities to impersonate that resource. This could expose the credentials and query data that Retool sends to it. Resources configured with an IP address as their host are the most exposed. Until you upgrade, prefer DNS hostnames over IP addresses in resource configurations.

CVE-2026-105482: DNS resolution of names with NUL characters

The Node.js dns.resolve functions truncate a hostname at the first NUL character, so they can resolve a different name than the one requested. Retool uses these functions in checks that block requests to private IP addresses. In those checks, Retool reads the hostname from a parsed URL, which can't contain a NUL character. Based on our assessment, this vulnerability isn't exploitable in Retool.

CVE-2026-105481: HTTP keep-alive responses

When Node.js reuses a connection for more than one HTTP request, it could treat data that a server sent before a request as the response to that request. Retool reuses connections for outbound HTTP requests, including resource queries. Retool only reuses a connection for requests to the same server, so a malicious server can only affect responses that already come from that server. We assess the impact on Retool as low.

CVE-2026-106073: Permission model bypass

The Node.js permission model restricts which files a process can access, and fs.realpathSync could bypass these restrictions. When AI App Builder runs tests for an app inside its sandbox, Retool uses the permission model as an extra restriction on which files the tests can read. A bypass could let test code read other files inside the sandbox. The sandbox's own isolation still applies, so we assess the impact on Retool as low.

Vulnerabilities that don't affect Retool

Some vulnerabilities in the release don't affect Retool:

• CVE-2026-106074 causes values from crypto.randomUUID() and crypto.randomInt() to repeat across processes started from a user-land startup snapshot or a single executable application. Retool doesn't use either feature.
• CVE-2026-105483, CVE-2026-106070, and CVE-2026-106071 only affect Node.js 24 or Node.js 26. Retool uses Node.js 22.

What versions are affected?

Self-hosted Retool only.

Release branch	Release versions
Edge	Before 4.81.0
4.34-stable	4.34.0 to 4.34.10
4.0-stable	4.0.0 to 4.0.23
3.334-stable	3.334.0 to 3.334.31

What versions contain the fix?

Self-hosted Retool only.

Branch	Versions	Released
Edge	4.81.0+	October 23, 2026, at 3:56 PM PDT
4.34-stable	4.34.12+	October 23, 2026, at 7:48 AM PDT
4.0-stable	4.0.25+	October 23, 2026, at 7:51 AM PDT
3.334-stable	3.334.32+	October 23, 2026, at 5:39 PM PDT

Revision history

• October 23, 2026: Initial publication with fixed Stable versions 4.34.12 and 4.0.25.
• October 29, 2026: Added Edge 4.81.0 and Stable 3.334.32. Documented the separate system Brotli library path (Debian libbrotli1 and Wolfi libbrotlidec).

Questions

For the full Node.js advisory, refer to the Node.js October 2026 security releases. If you have any questions or concerns, contact security@retool.com.