10 Security Flaws Detected in Govt and Bank Websites

Pakistan's National Cyber Emergency Response Team (National CERT) has cautioned organizations concerning 10 security vulnerabilities in Node.js, one of the most widely applied web technologies, urging them to update affected systems immediately.

Key points

• National CERT has directed organizations to upgrade affected systems to Node.js versions 22.23.4, 24.22.1, and 26.12.1 or afterwards.
• One of the most serious problems, identified as CVE-2026-111497, involves an out-of-bounds write in Node.js's Brotli decompression component.
• Binance Customers Pull Almost $5 Billion Within Hours of Reopening.
• The vulnerabilities could expose systems to remote code execution, memory corruption, unauthorized access, and weaknesses in encrypted connections.
• The advisory classifies four vulnerabilities as high severity, three as medium severity, and three as low severity.

Meanwhile, the vulnerabilities could expose systems to remote code execution, memory corruption, unauthorized access, and weaknesses in encrypted connections. The warning covers Node.js versions 22.x, 24.x, and 26.x, with the Node.js Project releasing security updates on October 21, 2026.

Meanwhile, the advisory classifies four vulnerabilities as high severity, three as medium severity, and three as low severity. National CERT has cautioned that administration departments, financial institutions, critical information infrastructure, and other organizations using Node.js applications could be affected. Hackers Play Explicit Video on Billboard in Egypt. Serious Security Flaws Could Allow Remote Code Execution.

One of the most serious problems, identified as CVE-2026-111497, involves an out-of-bounds write in Node.js's Brotli decompression component. Attackers could exploit the flaw by sending specially crafted compressed data, potentially executing arbitrary code, crashing applications, or accessing sensitive process memory.

Other vulnerabilities could allow DNS manipulation, improper TLS certificate validation, unauthorized HTTP responses, predictable cryptographic identifiers, and access to restricted filesystem locations.

National CERT has identified internet-facing services, API gateways, backend systems, cloud-hosted applications, containers, and continuous integration and deployment pipelines as areas requiring particular attention. While proof-of-concept code for memory corruption has additionally been published, although widespread active exploitation has not been established, researchers have demonstrated remote code execution against an official Node.js build. Anthropic is Regarding to Achieve Self Building AI. National CERT Urges Immediate Node.js Updates.

National CERT has directed organizations to upgrade affected systems to Node.js versions 22.23.4, 24.22.1, and 26.12.1 or afterwards. It has additionally advised organizations to identify all Node.js installations throughout servers, cloud platforms, development environments, and third-party applications.

Organizations have been specifically advised to prioritize applications that process untrusted Brotli-compressed data and obtain software updates only through the official Node.js website or trusted package repositories. The advisory additionally recommends strict hostname validation, rejecting malformed hostnames and ambiguous IP address representations, and maintaining TLS certificate verification.

In practice, the cybersecurity team has further pressed organizations to monitor unexpected application crashes, memory faults, unusual processes rolled out by Node.js services, suspicious outbound connections, and unauthorized filesystem access. Binance Customers Pull Almost $5 Billion Within Hours of Reopening.

Extra recommendations include container isolation, network segmentation, restricted application privileges, and updated certificate trust stores, including measures addressing the compromised eMudhra intermediate certification authority.

Organizations that detect suspicious activity or feasible exploitation have been instructed to activate incident-response procedures, preserve application and network logs, isolate affected systems where necessary, and install security patches. National CERT has additionally advised reporting incidents through its incident reporting portal, email, or designated contact number.

Meanwhile, the advisory emphasizes that temporary security measures can reduce exposure but cannot replace installing the fixed software versions. Stay Connected with ProPakistani.

Obtain the latest tech news, telecom insights, and product launches wherever you prefer. Follow on Google Discover. Follow on Google News Join WhatsApp. See more ProPakistani stories in Google Search and Top Stories.

Taken together, the developments around 10 Security Flaws Detected in Govt and Bank Websites point to a situation that is still moving, and the coming days should bring more clarity.