National CERT Warns of 10 Security Flaws in Widely Used Node.js Software

Pakistan's National Cyber Emergency Response Team (National CERT) has issued an advisory warning organizations about 10 security vulnerabilities in Node.js, a widely used web technology, and has urged them to update affected systems without delay. The alert is aimed at government departments, financial institutions, critical information infrastructure operators and other organizations running Node.js applications.

According to the advisory, the flaws could expose systems to remote code execution, memory corruption, unauthorized access and weaknesses in encrypted connections. The vulnerabilities affect Node.js versions 22.x, 24.x and 26.x, and the Node.js Project released security updates addressing them on October 21, 2026. Four of the issues are rated high severity, three medium and three low.

The most serious flaw, tracked as CVE-2026-111497, is an out-of-bounds write in Node.js's Brotli decompression component. Attackers could exploit it by sending specially crafted compressed data, potentially executing arbitrary code, crashing applications or reading sensitive process memory. Other vulnerabilities could enable DNS manipulation, improper TLS certificate validation, unauthorized HTTP responses, predictable cryptographic identifiers and access to restricted filesystem locations.

National CERT identified internet-facing services, API gateways, backend systems, cloud-hosted applications, containers and continuous integration and deployment pipelines as areas needing particular attention. While widespread active exploitation has not been confirmed, researchers have demonstrated remote code execution against an official Node.js build, and proof-of-concept code for memory corruption has been published.

Organizations have been directed to upgrade to Node.js versions 22.23.4, 24.22.1 and 26.12.1 or later. They are also advised to inventory all Node.js installations across servers, cloud platforms, development environments and third-party applications, prioritizing systems that process untrusted Brotli-compressed data. Software should only be obtained from the official Node.js website or trusted package repositories.

The advisory further recommends strict hostname validation, rejection of malformed hostnames and ambiguous IP address representations, and maintained TLS certificate verification. Organizations should monitor for unexpected application crashes, memory faults, unusual processes launched by Node.js services, suspicious outbound connections and unauthorized filesystem access. Additional measures include container isolation, network segmentation, restricted application privileges and updated certificate trust stores, including steps addressing the compromised eMudhra intermediate certification authority.

Any organization detecting suspicious activity has been instructed to activate incident-response procedures, preserve application and network logs, isolate affected systems where necessary and install security patches. Incidents can be reported through National CERT's reporting portal, email or designated contact number. The advisory stressed that temporary mitigations can reduce exposure but cannot replace installing the fixed software versions.