PKCERT warns government and banks of critical Node.js flaws

Pakistan's National Cyber Emergency Response Team (PKCERT) has warned government departments and financial institutions about critical security flaws in Node.js, the software many web services use to run server-side applications, and told affected organisations to install security updates immediately. The advisory was issued on October 26 and reported by TechJuice, which said PKCERT warned that the flaws allow attackers to execute remote code, bypass TLS certificate authentication and expose sensitive information.

The Node.js project has released fixes for 10 vulnerabilities (four rated high severity, three medium and three low) affecting versions 22.x, 24.x and 26.x. The most serious, tracked as CVE-2026-111497, is an out-of-bounds write in the Brotli decompression component that attackers can trigger with crafted compressed data, letting them run arbitrary code, crash applications or read process memory.

According to the report, PKCERT said successful exploitation could also let attackers manipulate DNS, have improper TLS certificates accepted, reach unauthorised filesystems and disrupt services. Applications that process untrusted compressed data or handle external requests carry the highest risk, it said, along with government systems, critical information infrastructure and third-party applications.

Security firm Imperva demonstrated a working remote code execution against an official Node.js 24.22.0 build, and Red Hat documented publicly available proof-of-concept code that triggers memory corruption and application crashes, the report said. PKCERT said it has not confirmed widespread active exploitation so far.

Organisations were told to inventory every Node.js installation, including embedded applications, container images, CI/CD pipelines and developers' workstations, and to prioritise internet-facing services, API gateways, backend systems and cloud-hosted applications. Where patching will take time, PKCERT advised interim steps: restricting the processing of untrusted Brotli-compressed data, enforcing request-size limits, tightening network access controls, strictly validating hostnames and enforcing TLS certificate verification. It said these measures do not replace official updates. IT teams were also asked to refresh certificate trust stores over concerns about a compromised eMudhra intermediate certification authority.

Security teams were asked to watch for unusual Node.js crashes, unexpected child processes, memory faults, suspicious outbound connections and unauthorised filesystem access. After patching, organisations should rebuild and redeploy container images, restart services and run security testing, and report suspected exploitation to PKCERT's incident portal while preserving network logs.

In a separate report, ProPakistani said researchers had confirmed active exploitation of two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, within days of emergency patches being released. Researcher Adel Karimi, who works at Perplexity, recorded 35 successful command executions across three honeypot servers on October 24 from two IP addresses, the outlet reported. Fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.