cisco-sa-oct2026-node-js-Jj3SQ19uHighCVSS 7.4

Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026

Published
October 27, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (4)

CVE-2026-105482 →CVE-2026-105483 →CVE-2026-106069 →CVE-2026-111497 →

📋 Description

On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x.

These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release ["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"].

The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory:

CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits CVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addresses

For information about Splunk products and offerings, see Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026 ["https://advisory.splunk.com/advisories/SVD-2026-1015"]

This investigation was expanded to cover Brotli outside of Node.js on October 30, 2026. The Brotli decoder flaw (CVE-2026-111497), which is in the Google Brotli C decoder, is often bundled with or linked to other software, so products beyond Node.js may be affected. For software that may be affected, see Broccoli2Shell ["https://broccoli2shell.com/"].

Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.

This advisory will be updated as additional information becomes available.

CVE-2026-106069 — Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026 (CVSS 3.0 7.4, CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CVE-2026-105482 — Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026 (CVSS 3.0 7.4, CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CVE-2026-105483 — Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026 (CVSS 3.0 7.4, CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CVE-2026-111497 — Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026

🎯 Affected products18

  • Cisco AppDynamics
  • Cisco Catalyst Center
  • Cisco CloudCenter
  • Cisco Firepower Extensible Operating System (FXOS)
  • Cisco ISE Passive Identity Connector
  • Cisco Identity Services Engine Software
  • Cisco License On-Prem
  • Cisco NX-OS Software
  • Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Data Center Network Manager (DCNM)
  • Cisco Secure Endpoint
  • Cisco Secure Endpoint Private Cloud Administration Portal
  • Cisco Secure Endpoint Private Cloud Console
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
  • Cisco Secure Firewall Management Center (FMC)
  • Cisco Secure Firewall Threat Defense (FTD) Software
  • Cisco Secure Malware Analytics
  • Cisco Smart License Utility
  • Cisco Virtualized Infrastructure Manager

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.

🔗 References (14)