Хочете будувати кар’єру в Data Science та AI? Vodafone Big Data Lab відкриває новий набір —>
Наталя ХандусенкоHot News
23 October 2026, 14:30
2026-10-23
After PHP, it's Node.js' turn: critical vulnerability puts millions of sites at risk
While the world recovers from the downfall of PHP sites, Node.js developers are calling for immediate system updates due to new critical vulnerabilities that threaten millions of resources.
Node.js developers have released urgent patches for 10 vulnerabilities and are urging immediate system updates. The platform powers over 6 million sites, including giants like Netflix, PayPal, Walmart, LinkedIn, Uber, and NASA.
While the world recovers from the downfall of PHP sites, Node.js developers are calling for immediate system updates due to new critical vulnerabilities that threaten millions of resources.
Node.js developers have released urgent patches for 10 vulnerabilities and are urging immediate system updates. The platform powers over 6 million sites, including giants like Netflix, PayPal, Walmart, LinkedIn, Uber, and NASA.
The most dangerous of the discovered vulnerabilities is tracked under the identifier CVE-2026-111497, Cybernews reports . It concerns the Brotli decoder, a popular data compression algorithm used by browsers and servers to speed up the loading of HTML, CSS, JavaScript, and API responses.
Exploiting this vulnerability could allow attackers to perform remote code execution (RCE), which could run malicious programs on the server and gain access to databases, API keys, and private user data. It could also cause a denial of service (DoS) attack that could cause massive website crashes, stop streaming video, lock accounts, or cause delays in services like taxis.
“Node.js powers the backend of many large platforms, which typically store database credentials and API keys. When an attacker gains access to the code, they gain access to everything the application has access to,” warns Shane Barney, director of information security at Keeper Security.
Although no real attacks have been reported online, cybersecurity experts have already published proof-of-concepts (PoCs) to demonstrate the problem. Researchers from Imperva successfully demonstrated full remote code execution in a Node.js 24.22.0 (Linux arm64) environment, calling the case Node2Shell (similar to PHP2Shell).
The Vercel cloud platform noted that the threat arises when an application or its libraries unpack Brotli data controlled by an attacker.
This incident occurred just days after emergency patches for PHP (which powers about 70% of sites with known server-side languages), and the cybersecurity community has already dubbed this period “Black October” due to a surge in AI-based attacks.
“Millions of independent services depend on a relatively small set of languages, runtimes, and libraries. When a critical vulnerability is found in a fundamental component, millions of sites are simultaneously at risk,” says Sai Molij, senior manager of threat analysis at Forescout.
Experts compare the situation to the large-scale libwebp library crisis in 2023, which affected Chrome, Telegram, Edge, and many other applications.
The security updates released on October 21 cover Node.js 26.x, 24.x, and 22.x branches. Experts urge you to immediately:
update Node.js to the latest secure version;
rebuild Docker images and restart servers;
abandon outdated versions that no longer receive security patches;
verify compliance with the principle of least privilege and rules for preserving secrets (API keys).
