PHP Warns of Two Critical Vulnerabilities, Emergency Patches Due Today at 14:00 UTC
The PHP team has warned of two critical flaws rated CVSS 9.2. Patches are due October 21 at 14:00 UTC, so admins should get their updates ready now.
Vulnerabilities
Node.js Security Update Fixes Brotli Decompression Flaw That Could Enable Code Execution
Node.js 22.23.4, 24.22.1 and 26.12.1 fix flaws in Brotli decompression, DNS resolution and TLS certificate checks. Update runtimes and containers now.
On October 21, Node.js released security updates 22.23.4, 24.22.1 and 26.12.1. One of the fixes addresses CVE-2026-111497, a flaw in the Brotli decoder that could allow remote code execution. The fix is in the runtime itself, so updating your application’s dependencies may not be enough.
What was fixed
The Brotli decoder bug allows data to be written outside the memory that was allocated for it. The Node.js project rates it as high severity and lists the 22.x, 24.x and 26.x release lines as vulnerable. How much it matters for a given application depends on several things, including whether the application processes compressed data that an attacker controls.
The release also fixes how hostnames are checked in TLS certificates and how dns.resolve handles names. Some of these issues involve IP addresses written in unusual formats. The DNS flaw involves names that contain a NUL character. When you plan the rollout, don’t look only at Brotli handling.
Where to look for vulnerable versions
Check application servers, container images, developer machines and CI/CD build environments. Your own container images may still include an old Node.js runtime even after the host system has been updated.
The provider easyDNS also published an advisory about these updates on October 21. It points out that release lines that are no longer supported do not get fixes. Deployments on those lines need to move to a supported line, after checking that the application still works on it.
What to do now
- Take inventory of the Node.js versions in running processes and in images.
- Deploy 22.23.4, 24.22.1 or 26.12.1, depending on the release line you use.
- Rebuild containers and restart any services still running on the old runtime.
- After the update, test decompression, TLS connections and name resolution.
- Get confirmation from managed service providers that they have applied the update.
SecurHUB’s take
Check that the update is actually in effect on the running process, not just in a configuration file. Security audits help find older runtimes and make clear who is responsible for maintaining them.
