[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEE4VmeX20AFL6gxY-0WMLr2jJ5hmYTyYKUmf5kYh730":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"09e16576-65bc-4c26-9875-32b7667b7be8","millions-of-unpatched-nodejs-installs-expose-organizations-to-remote-code-execution","f4f92c1e-1751-4225-ab14-34737502ae4c","Millions of Unpatched Node.js Installs Expose Organizations to Remote Code Execution","A critical Brotli decoder flaw (CVE-2026-111497) in Node.js enables remote code execution, yet Qualys telemetry shows that only 42,000 of 3.3 million installations have been updated — a patch adoption rate of barely 1.3%. More alarming, 1.7 million instances run end-of-life versions that will never receive a fix, leaving a massive permanent attack surface. This incident illustrates that vulnerability management is not just about knowing a patch exists, but operationalizing its deployment at scale and within a defined remediation window. Organizations without mature patch pipelines or software inventory controls are effectively flying blind, unable to distinguish patched assets from exposed ones.","**Immediate actions:**\n- Apply Node.js security updates to versions 22.23.4, 24.22.1, or 26.12.1 immediately for all in-support installations.\n- Deploy WAF rules, IPS signatures, and EDR policies to detect and block Brotli-related exploit attempts as a compensating control while patching is completed.\n- Disable or restrict Brotli content-encoding at the network or application layer on systems that cannot be patched immediately.\n\n**Long-term improvements:**\n- Maintain a continuously updated software inventory (SBOM) that flags end-of-life runtimes and unsupported dependencies before they become unresolvable liabilities.\n- Establish mandatory remediation SLAs tied to CVSS severity, ensuring critical RCE vulnerabilities are patched within 72 hours for internet-facing systems.\n- Migrate all end-of-life Node.js deployments to supported LTS versions through a formal lifecycle management programme.\n\n**Detection measures:**\n- Implement continuous vulnerability scanning across all environments so that newly disclosed CVEs are correlated against live asset inventory within hours of disclosure.\n- Configure SIEM and EDR alerting for anomalous process execution patterns consistent with Node.js runtime exploitation, such as unexpected child process spawning.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"CIS Control 2: Inventory and Control of Software Assets":25,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":26},"NIS2 requires essential and important entities to implement policies on vulnerability handling and patching; the scale of unpatched Node.js deployments would constitute a direct failure of this obligation for in-scope organizations.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through timely patching; any Node.js deployment handling cardholder data and left unpatched would be a clear PCI DSS violation.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined time periods; the near-zero patch adoption rate demonstrates this control is not implemented or enforced.","Running 1.7 million end-of-life Node.js installations is a textbook example of A06, where organizations fail to track, upgrade, or replace components that are no longer receiving security fixes.","With only 1.3% of installations patched, organizations clearly lack a continuous vulnerability management process that would enforce scanning, prioritization, and time-bound remediation for critical RCE flaws like this one.","The inability to identify 3.3 million Node.js instances — including 1.7 million end-of-life versions — stems directly from the absence of an authoritative software asset inventory that would surface unsupported runtimes.","This control mandates timely identification and remediation of technical vulnerabilities; the article's evidence of slow patch adoption and untracked EOL deployments shows this control is absent or ineffective.","published","2026-10-28T07:20:23.475849+00:00","2026-10-28T07:20:23.438+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F10\u002F27\u002Fcant-patch-node-js-yet-build-a-stopgap-with-the-controls-you-own","can-t-patch-node-js-yet-build-a-stopgap-with-the-controls-you-own-50be5d","Can’t Patch Node.js Yet? Build a Stopgap with the Controls You Own",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52,55],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them."]