PHP Followed by Node.js…"Web Infrastructure Security Week" Overlaps in One Week

After PHP, now it's Node.js. The two major foundational technologies of global web services released emergency security patches consecutively in the same week. The Node.js project released a security update on the 21st (local time) and announced that it fixed 10 vulnerabilities, including the possibility of remote code execution. It was the same day the 'PHP2Shell' patch came out.

Node.js is one of the most widely used runtime environments for building servers that process data behind website screens, or so-called backends. A considerable number of API servers and web services of startups both domestically and internationally run on this. This is why the impact of this patch is as significant as the PHP incident.

Among the fixed vulnerabilities, four are rated as 'high' severity. The most notable is a defect (CVE-2026-111497) where out-of-bounds memory writes occur while decompressing compressed data (Brotli); for servers processing compressed data sent from external sources, this could lead to remote code execution. Two additional defects that can bypass certificate verification in secure communications (TLS) have also been fixed. These are holes where fake servers can impersonate real ones when IP addresses are written in full-width numbers or hostnames are loosely interpreted as IPs. Even a defect where addresses are mishandled if special characters (NUL) are embedded in DNS names—all four target the communication channels between servers and external entities.

Additionally, two mid-level severity issues including HTTP connection persistence handling errors and a cryptographic random number repetition defect, along with four low-severity issues, were fixed together, and security updates for core components bundled with Node.js such as OpenSSL, c-ares, SQLite, and Undici were also included.

The response is straightforward. The patched versions are 26.12.1, 24.22.1, and 22.23.4; server operators should update to the appropriate patched version for their version series and restart their services. If you are using an old version that is no longer supported (version 20 or earlier), upgrading to a supported version is the fundamental solution. Starting with a single command (node -v) to check your version is the first step.

As PHP and Node.js were shaken consecutively within a week, the security industry calls this week the 'Web Infrastructure Security Week'. Since the open-source technologies that form the foundation of the web are used for free, following patches is the only price of use. As the PHP2Shell incident demonstrated, vulnerabilities go on attackers' schedules the moment they are disclosed.