National CERT flags 10 Node.js flaws for banks, ministries

National CERT says Node.js flaws put ministry and bank systems at risk of remote code execution until operators install the October 2026 fixed builds.

National CERT has flagged 10 Node.js flaws that can enable code execution, memory damage, illicit access and weaker encrypted links.

Releases in the 22, 24 and 26 lines are covered; corrected builds arrived on 21 October 2026.

Four issues are high severity, three medium and three low; ministries, banks and critical digital systems may be exposed.

CVE-2026-111497 abuses Brotli decompression; researchers have shown code execution on an official build, though mass active abuse is unconfirmed.

Operators should move to 22.23.4, 24.22.1 or 26.12.1 (or newer) and report incidents to National CERT.

Read the full story