National CERT tells Pakistani organisations to patch Node.js flaws that allow remote code execution
The advisory covers ten vulnerabilities fixed on 21 October, including a Brotli decoder flaw for which Red Hat has documented public proof of concept code.
Pakistan's National Cyber Emergency Response Team has told government bodies, critical infrastructure operators and financial institutions to patch Node.js immediately. Flaws fixed by the Node.js Project on 21 October can let an attacker run code on a server through specially crafted compressed data. The advisory, dated 26 October, rates the risk as high.
Node.js is a widely used server runtime, and the advisory covers servers, containers, CI and CD pipelines and third party applications that embed it, so its reach goes well beyond government.
The flaws and the fixes
The ten vulnerabilities are four rated high, three medium and three low. They affect Node.js 22.x, 24.x and 26.x. Organisations should move to version 22.23.4, 24.22.1 or 26.12.1, or later, and migrate any end of life version to a maintained release.
The most serious is a flaw in the Brotli decoder that ships with Node.js. According to the Node.js Project, malformed compressed input can write past the end of an internal buffer. An application that decompresses attacker supplied Brotli data with the built in zlib module can then suffer memory corruption, a crash, disclosure of process memory or remote code execution. The project credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer with reporting it.
NCERT says the security firm Imperva demonstrated remote code execution against an official Node.js 24.22.0 build, which the patched 24.22.1 rejected, and that Red Hat has documented public proof of concept code that causes memory corruption. It says widespread active exploitation has not been established.
The other high severity flaws involve DNS hostname handling with embedded null characters and TLS certificate checks that can be bypassed with unusual forms of IP addresses. Lower rated issues include acceptance of unsolicited HTTP responses on reused connections, predictable cryptographic identifiers and two filesystem permission bypasses.
What the advisory asks for
NCERT tells organisations to list every Node.js installation, including those embedded in applications, container images, CI and CD pipelines and developer machines, and to patch internet facing services first. If patching must wait, it suggests limiting how untrusted Brotli data is processed, setting request size limits and tightening network access. It says these steps do not replace the updates.
After patching, teams should rebuild and redeploy container images, restart services and test. They should watch for unexplained Node.js crashes, unexpected child processes and suspicious outbound connections, and report incidents through the National CERT portal.
The release also revokes the compromised eMudhra intermediate certificate authority from the default trust store, and NCERT wants those trust store updates deployed alongside the runtime patches.
