Vulnerabilities in Node.js Affecting Cisco Products: October 2026

Description

On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release . The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory: CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits CVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addresses For information about Splunk products and offerings, see Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026 Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u Security Impact Rating: High

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Details

Vendor

Cisco

Product

Node.js

CVE

CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069

Affected versions

Brotli 1.0: from 1.0.3 to 1.0.10 (excluded) — fixed in 1.0.10
Brotli 1.1: from 1.1.0 to 1.1.1 (excluded) — fixed in 1.1.1
Brotli 1.2: from 1.2.0 to 1.2.1 (excluded) — fixed in 1.2.1
node 22.23: from 22.23.3 to 22.23.3
node 24.22: from 24.22.0 to 24.22.0
node 26.12: from 26.12.0 to 26.12.0 (from the advisory and NVD; check the exact builds in the official advisory)

CVSS score

9.8

Actively exploited

Not known at this time

Source

Cisco PSIRT – original advisory

Published

October 30, 2026

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.