Vulnerability could allow remote attackers to take control of servers

Security community on alert as flaws emerge in PHP and Node.js in quick succession

[123RF]
[123RF]

A security vulnerability that could allow outside attackers to remotely control servers has been discovered in Node.js, a widely used software runtime environment, following a similar flaw found in the web development language PHP.

According to the security industry, the Node.js project announced Thursday through an official security advisory that a vulnerability (CVE-2026-111497) capable of enabling remote code execution had been found in the Brotli decompression module bundled with Node.js. Node.js is a software runtime environment widely used for web server and application back-end development.

An attacker exploiting the vulnerability could abnormally shut down a server or remotely execute malicious code without any authentication. However, the actual risk of exploitation varies depending on how the server processes compressed data and the runtime environment in use.

The research team that reported the vulnerability is OpenAI's Codex security team. The Node.js development team classified the vulnerability's severity as High and released security patches for the affected versions — 22.23.4, 24.22.1 and 26.12.1.

The Korea Internet & Security Agency also issued a security advisory on the vulnerability and recommended that users running affected versions of Node.js apply the latest security updates.

South Korean cybersecurity firm Theori released emergency response guidelines for businesses and organizations Monday. Theori said systems could be exposed to attack due to a flaw in the Node.js runtime itself, and said organizations that use automatic decompression of externally supplied compressed data should check whether they are vulnerable to exploitation.

With security flaws now found in both PHP and Node.js, alarm bells are ringing over the security of websites.

The PHP vulnerabilities discovered earlier include two flaws: an "Improper Handling of Exceptional Conditions" vulnerability (CVE-2026-109618), which fails to properly handle exceptional situations, and a "Use After Free" vulnerability (CVE-2026-109619), which references memory that has already been freed.

A separate remote code execution vulnerability arising during session handling has also been discovered — one that persists even after previously released security patches are applied.

In response, the Korea Internet & Security Agency recommended that users disable the file upload progress tracking feature until a security update becomes available.


sjpark@heraldcorp.com