Pakistan’s National Cyber Emergency Response Team (National CERT) has issued a security warning about 10 vulnerabilities in Node.js, a widely used technology for running web applications, urging organizations to install the latest security updates.
The flaws could allow attackers to execute malicious code remotely, corrupt memory, gain unauthorized access to systems, and exploit weaknesses in encrypted connections.
The warning covers Node.js versions 22.x, 24.x, and 26.x. The Node.js Project released security patches for the vulnerabilities on October 21, 2026.
According to the advisory, four vulnerabilities carry high severity ratings, three are classified as medium, and the remaining three are rated low.
National CERT has warned that government departments, financial institutions, critical information infrastructure, and other organizations running Node.js-based applications could face security risks.
Critical Flaw Could Let Hackers Execute Malicious Code
One of the most serious vulnerabilities, tracked as CVE-2026-111497, affects the Brotli decompression component of Node.js and involves an out-of-bounds memory write.
An attacker could exploit the flaw by sending specially crafted compressed data to a vulnerable application. This could potentially allow them to execute arbitrary code, crash applications, or access sensitive information stored in process memory.
Other reported weaknesses could expose systems to DNS manipulation, improper verification of TLS security certificates, unauthorized HTTP responses, predictable cryptographic identifiers, and access to restricted filesystem locations.
National CERT has identified internet-facing services, API gateways, backend systems, cloud-hosted applications, containers, and software development and deployment pipelines as areas requiring immediate attention.
Although widespread active exploitation has not been confirmed, researchers have demonstrated remote code execution against an official Node.js build. Proof-of-concept code demonstrating memory corruption has also been made public.
Organizations Told to Update Node.js Immediately
National CERT has advised organizations to upgrade affected installations to the following patched versions or later:
- Node.js 22.23.4
- Node.js 24.22.1
- Node.js 26.12.1
Organizations have also been instructed to identify all Node.js installations across their servers, cloud platforms, development environments, and third-party applications.
Particular attention should be given to applications that process untrusted Brotli-compressed data. Updates should only be obtained through the official Node.js website or trusted software package repositories.
The advisory also recommends strict hostname validation, rejecting malformed hostnames and ambiguous IP address formats, and ensuring that TLS certificate verification remains enabled.
Organizations have been urged to monitor unexpected application crashes, memory-related errors, unusual processes launched by Node.js services, suspicious outgoing network connections, and unauthorized filesystem access.
Additional safeguards include isolating applications within containers, segmenting networks, restricting application privileges, and updating certificate trust stores. National CERT has also highlighted measures addressing the compromised eMudhra intermediate certification authority.
If suspicious activity or possible exploitation is detected, organizations should activate their incident-response procedures, preserve application and network logs, isolate affected systems where necessary, and install the relevant security patches.
National CERT has directed organizations to report cybersecurity incidents through its incident reporting portal, email, or designated contact number.
The advisory makes clear that temporary security measures can reduce exposure, but installing the patched Node.js versions remains necessary to address the vulnerabilities.
