Pakistan’s National Cyber Emergency Response Team has issued a fresh warning to organisations across the country about ten security weaknesses found in Node.js, a piece of software that sits behind a very large share of modern websites and online services. The alert, aimed in particular at government departments, banks and operators of critical systems, urges every organisation running the affected versions to move to the fixed releases without delay, rather than treating the warning as routine maintenance that can wait for the next convenient window.
Node.js is not a website or an application that most people ever see directly. It is a runtime environment that lets developers build fast, scalable network services using JavaScript, the language of the web browser, on the server side as well. That combination has made it a favourite for everything from small company portals to large banking platforms, payment gateways, booking systems and the application programming interfaces, or APIs, that let different services talk to one another. When a flaw is found in a tool this widely used, the potential exposure is correspondingly wide, because the same code can be present in hundreds of separate systems inside a single organisation.
The warning covers three supported lines of the software, versions 22, 24 and 26, and follows security releases published by the Node.js project on 21 October 2026. Of the ten weaknesses, four are rated high severity, three medium and three low. Severity ratings of this kind are not a measure of how interesting a flaw is to researchers; they reflect how much damage an attacker could do, how easily the flaw can be reached, and whether any special access is needed first. A high-severity flaw in an internet-facing service is therefore a priority even when there is no confirmed evidence yet that criminals are exploiting it at scale.
Serious flaws that could allow remote code execution
The most concerning weakness identified in the advisory relates to the way Node.js handles Brotli, a compression method used to shrink data before it is sent across the internet so that pages and services load faster. The flaw is described as an out-of-bounds write in the Brotli decompression component, which in plain terms means that specially prepared compressed data could cause the software to write information beyond the memory it was supposed to use. From there, an attacker may be able to run their own code, crash the service, or read sensitive material held in the process memory.
The advisory singles out the parts of an organisation’s estate that deserve the closest attention: services exposed directly to the internet, API gateways that route traffic between systems, back-end services, applications hosted in the cloud, software containers, and the continuous integration and deployment pipelines that build and release new versions of software. Those pipelines deserve special mention, because a compromise there can spread malicious code into every system that later receives an update from them. National CERT notes that widespread active exploitation has not been established, but researchers have already shown remote code execution against an official build, and demonstration code for memory corruption has been published, which shortens the time defenders have.
National CERT urges immediate updates
The core instruction in the advisory is straightforward: upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1, or a later fixed release in the same line, and do so for every installation, not only the obvious servers. Organisations are advised to map all of their Node.js installations, including those on cloud platforms, in development and testing environments, and inside third-party applications where the runtime may be bundled invisibly. A patch applied to the main website while an older copy keeps running in an internal tool leaves the door open in exactly the place an attacker is most likely to probe.
Applications that handle untrusted Brotli-compressed data should be patched first, and updates should be taken only from the official Node.js website or trusted package repositories. That caution matters because moments of high-profile vulnerability disclosure are also moments when fake update files circulate. The advisory further recommends strict validation of hostnames, rejecting malformed names and ambiguous forms of internet addresses, and keeping certificate verification switched on rather than weakening it to work around an unrelated problem.
The advisory also recommends the longer-term defences that reduce the damage when a flaw is found in future: isolating software containers from one another, splitting networks into segments so that a compromised web service cannot reach a database directly, running applications with only the privileges they need, and keeping certificate trust stores up to date, including action on the compromised eMudhra intermediate certification authority. Temporary workarounds can lower exposure for a few days, the advisory stresses, but they are not a substitute for installing the fixed software. For banks, government departments and critical infrastructure operators, whose systems hold citizens’ money and personal data, that distinction is the whole point: a known flaw with a published fix becomes steadily less defensible with every day it remains unpatched.
