Following PHP, Concerns Grow Over Node.js Website Hacking Vulnerabilities

A security vulnerability that allows external attackers to remotely control servers has been discovered in Node.js, a software execution environment widely used for website and server development.

According to the security industry, the Node.js project announced via an official security advisory on October 21 that a vulnerability (CVE-2026-111497) allowing remote code execution was found in the Brotli decompression module included in Node.js.

Node.js is a software environment that allows the JavaScript programming language to be executed outside of web browsers, and is extensively used for web servers and application backend development.

Attackers can exploit this vulnerability to crash servers or remotely execute malicious code without separate authentication procedures, though the actual possibility of an attack depends on the server's compressed data processing methods and execution environment.

The vulnerability was reported by the OpenAI Codex security team.

OpenAI previously stated that during containment breakout tests for its top-tier artificial intelligence (AI) model, AI agents independently discovered the potential vulnerability in Brotli.

The Node.js development team classified the severity of the vulnerability as "High" and released security patches for the affected versions: 22.23.4, 24.22.1, and 26.12.1.

The Korea Internet & Security Agency (KISA) also issued a security advisory regarding the vulnerability, urging users of affected Node.js versions to apply the latest security updates.
※ Please note: This article was translated by AI and may contain errors.