Kathmandu – The National Cyber Security Center (NCSC) has urged government agencies and system operators to immediately update Node.js, warning that a newly discovered Node2Shell vulnerability could let attackers take control of affected systems.
The advisory, issued on Wednesday by the centre under the Department of Information Technology and Electronic Governance at the Office of the Prime Minister and Council of Ministers, refers to serious flaws in the Node.js runtime, including Node2Shell, tracked as CVE-2026-111497.
Node.js is widely used to run websites, web applications and online services. According to the NCSC, if these weaknesses are exploited, attackers could gain unauthorised access, disrupt services and take over processes running on a system.
The flaw sits in the part of Node.js that decompresses Brotli-encoded data. International security agencies, including Singapore’s Cyber Security Agency, have rated it critical, with a CVSS score of 9.8 out of 10, because it can allow remote code execution.
The NCSC has asked all concerned bodies to check which version of Node.js their systems use and upgrade right away. Systems on Node.js 26 should move to version 26.12.1 or later, Node.js 24 to 24.22.1 or later, and Node.js 22 to 22.23.4 or later.
Older versions, including 25, 23, 20, 18 and earlier, no longer receive security fixes at all. For these, the centre recommends moving to a supported release, preferably Node.js 24 LTS or 26 LTS, after testing for compatibility. It also notes that Node.js 22 will reach end of life on April 30, 2027, so operators should start planning their migration.
Beyond the upgrade, the advisory asks operators to rebuild and redeploy their applications, containers and serverless functions on the patched runtime, and to make sure no old or bundled Node.js files remain in use. It also recommends reviewing apps that decompress Brotli data or handle responses from untrusted sources, checking DNS, outbound requests and TLS certificate verification, and looking for signs of attack.
Agencies whose systems are hosted at the government’s Integrated Data Management Center (IDMC) can coordinate with the NCSC and the IDMC for technical support with the update. If misuse is suspected, the centre has asked operators to preserve logs and other digital evidence and inform it immediately.
The warning comes less than a week after AI-discovered PHP flaws forced several Nepal government and bank websites offline, a reminder that patching is no longer something that can wait for a quiet week.
