Pakistan’s National Cyber Emergency Response Team (PKCERT) recently issued a severe warning to government departments and financial institutions. On October 26, PKCERT highlighted critical security flaws in Node.js software. These flaws enable attackers to execute remote code, bypass TLS certificate authentication, and expose highly sensitive information. Consequently, the agency strongly urges all affected organizations to install security updates immediately.
PKCERT Highlights Core Node.js Security Flaws & Exploitation Risks
The Node.js Project recently released fixes for 10 distinct vulnerabilities. These include four high-severity, three medium-severity, and three low-severity flaws. They affect Node.js versions 22.x, 24.x, and 26.x. The most serious vulnerability is CVE-2026-111497. This flaw triggers an out-of-bounds write in the Brotli decompression component. Attackers can feed maliciously crafted compressed data to vulnerable systems. As a result, they can execute arbitrary code, crash applications, or access process memory.
Furthermore, successful exploitation can lead to severe operational damage. Attackers can manipulate DNS, improperly accept TLS certificates, access unauthorized filesystems, and disrupt critical services. These vulnerabilities pose immense risks to government entities, critical information infrastructure, and third-party applications. Specifically, applications that process untrusted, compressed data or handle external requests face the highest danger.
Security firm Imperva recently demonstrated a successful remote code execution against an official Node.js 24.22.0 build. Additionally, Red Hat documented a publicly available proof-of-concept code. This code easily triggers memory corruption and application crashes. However, PKCERT confirms that widespread active exploitation has not started yet.
Immediate Upgrades & Mitigation Strategies
PKCERT directs all organizations to upgrade their Node.js versions immediately. IT teams must prioritize internet-facing services, API gateways, backend systems, and cloud-hosted applications.
| Vulnerable Versions | Safe Upgraded Versions |
| Node.js 22.x | Node.js 22.23.4 (or later) |
| Node.js 24.x | Node.js 24.22.1 (or later) |
| Node.js 26.x | Node.js 26.12.1 (or later) |
Organizations must quickly inventory all Node.js installations. This includes embedded applications, container images, CI/CD pipelines, and development workstations. If patching takes time, organizations should apply interim mitigations. System administrators must restrict the processing of untrusted Brotli-compressed data. They should also enforce request-size limits and strengthen network access controls.
Moreover, servers must strictly validate hostnames and enforce TLS certificate verification. PKCERT emphasizes that these interim measures do not replace the need for official security updates. Finally, IT teams must update their certificate trust stores to address concerns regarding a compromised eMudhra intermediate certification authority.
Incident Response & Continuous Monitoring
Organizations must proactively verify if attackers have compromised their systems. Security teams should monitor for unusual Node.js crashes and unexpected child processes. Furthermore, they must watch for memory faults, suspicious outbound connections, and unauthorized filesystem access.
After patching, affected systems require thorough validation. IT teams must rebuild and redeploy container images. They also need to restart services and conduct comprehensive security testing. If organizations detect suspected exploitation, they must activate incident-response procedures immediately. Finally, they should preserve all relevant network logs and report the incident through the National CERT Pakistan incident-reporting portal.
