LAHORE – Pakistan’s National Cyber Emergency Response Team (National CERT) has warned organisations about 10 security vulnerabilities in Node.js, urging them to update affected systems immediately.
Node.js is widely used to develop web applications and backend services. The identified flaws could expose systems to remote code execution, memory corruption, unauthorised access and weaknesses in encrypted connections.
The advisory covers Node.js versions 22.x, 24.x and 26.x. The Node.js Project released security updates on October 21, 2026, to address the reported vulnerabilities.
According to National CERT, four of the vulnerabilities carry high severity ratings, while three are classified as medium and three as low.
Government departments, financial institutions, critical information infrastructure and other organisations using Node.js applications could be affected.
Critical flaws could allow remote code execution
One of the most serious vulnerabilities, identified as CVE-2026-111497, involves an out-of-bounds write in Node.js’s Brotli decompression component.
Attackers could exploit the flaw by sending specially crafted compressed data. This could allow them to execute malicious code, crash applications or access sensitive process memory.
Other vulnerabilities could enable DNS manipulation, improper TLS certificate validation, unauthorised HTTP responses and access to restricted filesystem locations. Some flaws could also expose weaknesses in cryptographic identifiers.
National CERT has highlighted internet-facing services, API gateways, backend systems, cloud-hosted applications, containers and continuous integration and deployment pipelines as areas requiring particular attention.
Although widespread active exploitation has not been established, researchers have demonstrated remote code execution against an official Node.js build. Proof-of-concept code for memory corruption has also been published.
National CERT urges immediate security updates
National CERT has directed organisations to upgrade affected installations to the following versions:
- Node.js 22.23.4 or later
- Node.js 24.22.1 or later
- Node.js 26.12.1 or later
The cybersecurity team has also advised organisations to identify all Node.js installations across their servers, cloud platforms, development environments and third-party applications.
Organisations should prioritise applications that process untrusted Brotli-compressed data. They should also obtain updates through the official Node.js website or trusted package repositories.
The advisory recommends strict hostname validation, rejecting malformed hostnames and ambiguous IP address representations, and maintaining proper TLS certificate verification.
Organisations advised to monitor suspicious activity
National CERT has urged organisations to monitor unexpected application crashes, memory faults, unusual processes launched by Node.js services, suspicious outbound connections and unauthorised filesystem access.
Additional recommendations include container isolation, network segmentation, restricted application privileges and updated certificate trust stores. Organisations have also been advised to address risks associated with the compromised eMudhra intermediate certification authority.
If organisations detect suspicious activity or possible exploitation, they should activate their incident-response procedures. They should preserve application and network logs, isolate affected systems where necessary and install the relevant security patches.
National CERT has also instructed affected organisations to report incidents through its incident reporting portal, email or designated contact number.
The advisory emphasises that temporary security measures can reduce exposure. However, they cannot replace installing the security updates that address the vulnerabilities.
Key points:
- Pakistan’s National CERT has warned organisations about 10 security vulnerabilities affecting Node.js.
- The flaws could expose systems to remote code execution, memory corruption and unauthorised access.
- The advisory covers Node.js versions 22.x, 24.x and 26.x.
- Four vulnerabilities are classified as high severity, three as medium and three as low.
- Organisations have been urged to install security updates released on October 21, 2026.
- Recommended measures include updating affected systems, reviewing network activity and strengthening application security.
