PHP was just the beginning: Node.js unveils dangerous flaws threatening millions of sites

While the world reels from websites being taken down before critical PHP patches were released, Node.js is urging overnight updates to fix vulnerabilities that could crash millions more websites.

Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.

More than 6 million websites run on Node.js, with millions of people relying on services built on the platform. A breach of such a widely used tool could send shockwaves far beyond a single site.

Giants like Netflix, PayPal, Walmart, LinkedIn, Uber, and even NASA rely on Node.js for parts of their online services. At Netflix, Node.js helps connect users’ devices with the backend services that keep the platform running.

Attackers could crash video playback

The most severe flaw identified by Node.js is tracked as CVE-2026-111497. According to the Node.js project, its exploitation could lead to potential remote code execution or cause intentional service disruptions (DOS).

The vulnerability specifically affects the Brotli decoder. Brotli is a compression format that reduces data size, making websites load faster. Browsers and servers use it to shrink things like HTML, JavaScript, CSS, JSON, and API responses before sending them over the internet.

If the vulnerability were actually exploited within a large consumer platform, it could have highly visible consequences. Websites going down, pages breaking, users being locked out of their accounts, feeds disappearing, or rides being delayed.

A successful attack on a streaming platform exploiting CVE-2026-111497 could do more than ruin movie night. It may result in crashes or endless video buffering.

And, if attackers exploited it to run their own code on a backend server, the damage could go much further. They might gain access to user data, abuse internal systems, or disrupt billing, personalized recommendations, and video delivery.

A successful attack on the right backend service could expose sensitive data, disrupt core functionality, or let attackers hijack trusted internal actions behind the scenes.

This doesn’t mean every website running Node.js is suddenly at risk of being hacked. The real danger lies in specific features that attackers may be able to exploit, particularly those exposed to the internet.“

Node.js does not decode Brotli data on its own. Your application is exposed when its code, or a library it uses, decompresses Brotli data that an attacker controls, whether in a request body or in a response it fetches. Only the runtime patch covers fetched responses,” a cloud platform Vercel, stated in a security advisory.

Node.js exploit demonstrated in the wild by researchers

No attacks have been noted in the wild as of now, but the security community has already shared Proof of Concept (PoC) for potential exploits.

A public GitHub repository linked to CVE-2026-111497 suggests that security researchers have already published PoC code to demonstrate the Node.js Brotli decoder flaw in practice.

A user on X, going by the name m411k, has found a version of the Node.js flaw CVE-2026-111497 that can cause crashes or service disruptions. They said they are still working on demonstrating remote code execution, which could allow an attacker to run malicious code on a vulnerable system.

Could Node.js face another WebP-like security crisis that broke Chrome?

The newly discovered vulnerability in the Brotli decoder follows the same pattern as a flaw that was behind the WebP heist in 2023, which led to large-scale malware distribution campaigns.

The critical vulnerability in libwebp, a widely used library that allows software to display WebP images, was initially reported as a Chrome vulnerability.

However, it turned out to affect far more than a single browser, as the same library was built into browsers, messaging apps, office software, desktop applications, and systems that process images on servers. Chrome, Microsoft Edge, Mozilla, and Telegram were among those affected.

Attackers could exploit the flaw by tricking someone into viewing a malicious image or visiting a specially crafted webpage. In vulnerable software, this could corrupt memory and potentially allow attackers to run their own code.

Google confirmed that attackers exploited the vulnerability in the wild, while the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of known exploited vulnerabilities.

Updates of Node.js are urged

As the only way to secure applications, the cybersecurity community is urging to update Node.js. The security updates, released on October 21st, affect three versions (26.x, 24.x, and 22.x.) of Node.js.

“It's important to note that End-of-Life versions are always affected when a security release occurs. To ensure your system's security, please use an up-to-date version as outlined in our Release Schedule,” Node.js wrote in an advisory.

Administrators should update to the fixed version, rebuild application images if necessary, and restart affected services.

They should then test that secure connections, DNS lookups, compressed data processing, and file access restrictions are all working as expected.

What Node.js vulnerabilities have been patched?

• CVE-2026-105482: dns.resolve truncates names containing NUL char. Severity: high
• CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits. Severity: high
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address. Severity: high
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (). Severity: high
• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent. Severity: medium
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints. Severity: medium
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values. Severity: Medium
• CVE-2026-106070: Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation. Severity: low
• CVE-2026-106071: Permission Model filesystem over-grant via wildcard radix lookup. Severity: low
• CVE-2026-106073: Permission Model bypass with fs.realpathSync. Severity: low