Home / Items
Vendor advisoryKnown exploitedSeverity 7.4 highExploit likelihood 83%
Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026
cisco-sa-oct2026-node-js-Jj3SQ19u · Cisco · October 27, 2026
Summary
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x.
These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release ["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"].
The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory:
CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution
CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters
CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits
CVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addresses
For information about Splunk products and offerings, see Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026 ["https://advisory.splunk.com/advisories/SVD-2026-1015"]
This investigation was expanded to cover Brotli outside of Node.js on October 30, 2026. The Brotli decoder flaw (CVE-2026-111497), which is in the Google Brotli C decoder, is often bundled with or linked to other software, so products beyond Node.js may be affected. For software that may be affected, see Broccoli2Shell ["https://broccoli2shell.com/"].
Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
This advisory will be updated as additional information becomes available.
From Cisco (vendor's own words, quoted), quoted as published. Check the source before acting.
What to do
Cisco has released software updates that address this vulnerability.
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-106069 | 7.4 high | No | 0.3% |
| CVE-2026-105482 | 7.4 high | No | 0.5% |
| CVE-2026-105483 | 7.4 high | No | 0.3% |
| CVE-2026-111497 | Not scored | Exploited | 82.6% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Cisco | Cisco Secure Firewall Adaptive Security Appliance (ASA) Software |
| Cisco | Cisco NX-OS Software |
| Cisco | Cisco Identity Services Engine Software |
| Cisco | Cisco Secure Firewall Management Center (FMC) |
| Cisco | Cisco Secure Firewall Threat Defense (FTD) Software |
| Cisco | Cisco Secure Endpoint |
| Cisco | Cisco Firepower Extensible Operating System (FXOS) |
| Cisco | Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Data Center Network Manager (DCNM) |
| Cisco | Cisco Catalyst Center |
| Cisco | Cisco License On-Prem |
| Cisco | Cisco AppDynamics |
| Cisco | Cisco Virtualized Infrastructure Manager |
| Cisco | Cisco CloudCenter |
| Cisco | Cisco ISE Passive Identity Connector |
| Cisco | Cisco Secure Endpoint Private Cloud Administration Portal |
| Cisco | Cisco Secure Endpoint Private Cloud Console |
| Cisco | Cisco Secure Malware Analytics |
| Cisco | Cisco Smart License Utility |
Why it's on these mode pages
- Maritime: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
Change history
- October 27, 2026: Initial public release.
- October 28, 2026: Updated vulnerable products and products confirmed not vulnerable. Added link to Splunk advisory.
- October 29, 2026: Updated vulnerable products and products confirmed not vulnerable.
- October 30, 2026: Updated vulnerable products and products confirmed not vulnerable.
- November 2, 2026: Updated vulnerable products and products confirmed not vulnerable.
- November 4, 2026: Updated title, summary, vulnerable products, and products confirmed not vulnerable.
- November 5, 2026: Updated vulnerable products and products confirmed not vulnerable.
- November 5, 2026: Updated vulnerable products and products confirmed not vulnerable.
- November 6, 2026: Updated products under investigation, vulnerable products, and products confirmed not vulnerable.
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com