PHP Followed by Node.js…'Web Infrastructure Security Week' in a Single Week

First PHP, now Node.js. The two major foundational technologies of global web services have issued emergency security patches back-to-back in the same week. The Node.js project released a security update on the 21st (local time) and announced that it fixed 10 vulnerabilities, including the possibility of remote code execution. It was the same day the 'PHP2Shell' patch was released.

Node.js is one of the most widely used runtime environments for building servers that process data behind the scenes of websites, the so-called backend. A significant portion of domestic and foreign startups' API servers and web services run on it. This is why the impact of this patch is as significant as the PHP incident.

Among the fixed vulnerabilities, 4 are rated as 'high' severity. The most notable is a defect (CVE-2026-111497) that occurs when decompressing data (Brotli) causes writes outside the memory range. For servers processing compressed data sent from outside, this could lead to remote code execution. Two more defects that can bypass certificate verification in secure communication (TLS) have also been fixed. These are vulnerabilities where fake servers can impersonate real ones if IP addresses are written in full-width numerals or hostnames are loosely interpreted as IP addresses. Additionally, a defect where special characters (NUL) embedded in DNS names cause incorrect address processing—all four target the communication path between servers and the outside world.

In addition, 2 intermediate-level vulnerabilities such as HTTP connection maintenance processing errors and a defect where cryptographic random numbers can be repeated, along with 4 low-level vulnerabilities were fixed, and security updates for core components bundled with Node.js such as OpenSSL, c-ares, SQLite, and Undici were also included.

The response is straightforward. The patched versions are 26.12.1, 24.22.1, and 22.23.4. Server administrators should update to the patched version matching their current version series and restart the service. If running an old unsupported version (20 or earlier), upgrading to a supported version is the fundamental solution. The first step is to check the version with a single command (node -v).

As PHP and Node.js were shaken back-to-back within a week, the security industry is calling this week the 'Web Infrastructure Security Week.' Since the open-source technologies that form the foundation of the web are used free of charge, keeping up with patches is the only fee for usage. As the PHP2Shell incident demonstrated, the moment a vulnerability is disclosed, it gets added to attackers' schedules.