Security vulnerability found in Node.js after PHP; urgent update recommended

[Financial News] A vulnerability that could allow an external attacker to take control of a server has been found in Node.js, a software runtime environment used to develop websites and servers. Following recent findings of vulnerabilities in the PHP programming language, serious vulnerabilities have now been found in Node.js as well, prompting calls for companies to promptly review their security and install updates.
According to the security industry on the 26th, the Node.js project announced in an official security advisory on the 21st that a vulnerability allowing remote code execution had been found in the Brotli module, which decompresses data (CVE-2026-111497).
Node.js is a software environment that allows the JavaScript programming language to run outside web browsers and is widely used to develop web servers and applications.
The vulnerability stems from an error that occurs when compressed data is restored to its original state. If an attacker sends a maliciously crafted compressed data to a server, they can cause the server to shut down abnormally or expose its memory without any separate authentication. Under certain conditions, an attacker may be able to execute malicious code remotely and even take control of the server. Notably, systems may be exposed to attack even when developers do not directly use compression features. However, the actual risk of attack depends on how the server processes data and on its runtime environment.
The vulnerability was reported by OpenAI’s Codex security team. OpenAI had previously said that its AI agents had independently discovered potential vulnerabilities in Brotli.
The Node.js development team classified the vulnerability’s severity as “High” and released versions 22.23.4, 24.22.1 and 26.12.1 with a fix. Users of the 22.x, 24.x and 26.x series who are running versions older than these should install the latest security updates.
The Korea Internet & Security Agency (KISA) also issued a security advisory and recommended that users of affected Node.js versions install the update.
South Korea’s security industry has also begun responding. Security firm Theori, Inc. said it completed its own reproduction and verification of the vulnerability, known as “Node2Shell,” that day and released an urgent response guide. It also introduced temporary mitigation measures for companies unable to update immediately, along with a free online diagnostic service that checks the risk of exposure to the vulnerability when users enter only the service’s URL.
Lim Jun-o, head of Theori, Inc.’s AI and Cyber Research Team, said, “Even if developers do not directly use compression features, this vulnerability can automatically expose systems to attack as web frameworks process responses, making proactive prevention especially important,” and urged users to “take temporary measures and hurry to apply the latest patch.”
[email protected] Choi Hye-rim Reporter