PKCERT, the national cyber emergency team under Pakistan’s government, has put out a high-severity advisory telling government departments, financial institutions and other organisations to update Node.js without delay. The advisory, last updated on 26 October, covers ten security holes fixed by the Node.js project on 21 October.
The most serious is a memory-corruption bug in the Brotli decompression code that ships with Node.js. A specially crafted compressed file can make the decoder write past its buffer, which can crash an application, leak memory or, in the worst case, run an attacker’s code. Anything built on Node.js that decompresses data from outside, such as an API gateway or a web backend, is exposed.
The Node.js project’s security release notes list four high, three medium and three low severity issues across the 22.x, 24.x and 26.x lines. The Brotli flaw is tracked as CVE-2026-111497 and was reported by OpenAI Codex Security. Fixed builds are 22.23.4, 24.22.1 and 26.12.1; the project says end-of-life versions are affected too and should move to a supported release.
Three TLS and DNS bugs sit next to it
The other three high-severity fixes affect how Node.js handles hostnames and addresses. One lets a hostname containing a NUL character be cut short during a DNS lookup. Two let TLS certificate checks pass against the wrong address when an IPv4 address is written in an unusual way, for example with a leading zero or fullwidth digits. Apps that rely on domain allowlists or fetch URLs on a server’s behalf are the ones to check first.
The release also bumps bundled components, including OpenSSL, c-ares and Undici, and removes a compromised eMudhra intermediate certificate authority from Node.js’s default trust store.
What PKCERT wants done
The advisory (NCA-24.261026) tells organisations to list every Node.js install, including containers, CI/CD pipelines and developer machines, and to patch internet-facing services first. Where patching has to wait, it suggests limiting how much untrusted Brotli data is processed, setting request-size limits and tightening network access. After updating, teams should rebuild container images, restart services and report suspected abuse through the PKCERT portal.
PKCERT says widespread exploitation has not been established. It cites a remote-code-execution demonstration by Imperva against Node.js 24.22.0 and public proof-of-concept code from Red Hat that triggers memory corruption.
A different Brotli flaw hit Microsoft this week; we covered its emergency .NET patch on 27 October.
