Pakistan’s National Cyber Emergency Response Team (National CERT) has warned organizations about 10 security vulnerabilities in Node.js, one of the most widely used web technologies, urging them to update affected systems immediately.
The vulnerabilities could expose systems to remote code execution, memory corruption, unauthorized access, and weaknesses in encrypted connections. The warning covers Node.js versions 22.x, 24.x, and 26.x, with the Node.js Project releasing security updates on October 21, 2026.
The advisory classifies four vulnerabilities as high severity, three as medium severity, and three as low severity. National CERT has warned that government departments, financial institutions, critical information infrastructure, and other organizations using Node.js applications could be affected.
Serious Security Flaws Could Allow Remote Code Execution
One of the most serious issues, identified as CVE-2026-111497, involves an out-of-bounds write in Node.js’s Brotli decompression component. Attackers could exploit the flaw by sending specially crafted compressed data, potentially executing arbitrary code, crashing applications, or accessing sensitive process memory.
Other vulnerabilities could allow DNS manipulation, improper TLS certificate validation, unauthorized HTTP responses, predictable cryptographic identifiers, and access to restricted filesystem locations.
National CERT has identified internet-facing services, API gateways, backend systems, cloud-hosted applications, containers, and continuous integration and deployment pipelines as areas requiring particular attention. Although widespread active exploitation has not been established, researchers have demonstrated remote code execution against an official Node.js build, while proof-of-concept code for memory corruption has also been published.
National CERT Urges Immediate Node.js Updates
National CERT has directed organizations to upgrade affected systems to Node.js versions 22.23.4, 24.22.1, and 26.12.1 or later. It has also advised organizations to identify all Node.js installations across servers, cloud platforms, development environments, and third-party applications.
Organizations have been specifically advised to prioritize applications that process untrusted Brotli-compressed data and obtain software updates only through the official Node.js website or trusted package repositories. The advisory also recommends strict hostname validation, rejecting malformed hostnames and ambiguous IP address representations, and maintaining TLS certificate verification.
The cybersecurity team has further urged organizations to monitor unexpected application crashes, memory faults, unusual processes launched by Node.js services, suspicious outbound connections, and unauthorized filesystem access.
Additional recommendations include container isolation, network segmentation, restricted application privileges, and updated certificate trust stores, including measures addressing the compromised eMudhra intermediate certification authority.
Organizations that detect suspicious activity or possible exploitation have been instructed to activate incident-response procedures, preserve application and network logs, isolate affected systems where necessary, and install security patches. National CERT has also advised reporting incidents through its incident reporting portal, email, or designated contact number.
The advisory emphasizes that temporary security measures can reduce exposure but cannot replace installing the fixed software versions.
The post 10 Security Flaws Detected in Govt and Bank Websites appeared first on ProPakistani.
