Vulnerabilities in node.js Affecting Cisco Products: October 2026
Cisco has issued a security advisory warning of multiple critical vulnerabilities in Node.js that could enable remote code execution and traffic interception on its products.
On October 21, 2026, Node.js released fixes for multiple vulnerabilities affecting its supported release lines 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations including the Brotli decoder, DNS resolution, and TLS certificate validation, posing significant security risks for organizations using Cisco products.
The vulnerabilities identified have a Security Impact Rating (SIR) of High and include CVE-2026-111497 (Brotli decoder out-of-bounds write), CVE-2026-105482 (DNS resolution truncation), CVE-2026-105483 (TLS hostname validation bypass), and CVE-2026-106069 (TLS hostname validation bypass with noncanonical IP addresses).
Affected Products
Cisco is actively investigating its extensive product line to determine which devices may be affected by these vulnerabilities. The company has identified several priority products under investigation, including Catalyst SD-WAN Manager, Identity Services Engine (ISE), IOS Software, IOS XE Software, NX-OS Software, and various Secure Firewall products.
Additionally, numerous other products are being assessed, including AppDynamics solutions, Cable Devices, Collaboration and Social Media AI PODs, Network and Content Security Devices, and various routing and switching products. The investigation covers a wide range of Cisco's portfolio from networking equipment to security appliances and cloud services.
Cisco has emphasized that if a product is not listed in the advisory, it is not affected by these vulnerabilities. The company plans to update the advisory with specific bug IDs and platform-specific information as the investigation progresses.
Exploitation Status
The Cisco Product Security Incident Response Team (PSIRT) has confirmed that proof-of-concept exploit code is available for these vulnerabilities. However, the team has not observed any malicious use of these vulnerabilities against Cisco products at this time.
The Cisco PSIRT is not aware of any malicious use of these vulnerabilities against any Cisco product.
Customers are advised to regularly consult Cisco's security advisories to determine their exposure and implement necessary fixes. The company has stated that any workarounds will be documented in product-specific Cisco bugs identified in the advisory.
Next Steps
Cisco will continue updating the advisory as more information becomes available about affected products and necessary fixes. Customers are encouraged to check the Cisco Security Advisories page for the most recent version of this security advisory.
The vulnerabilities were originally disclosed by Node.js, and customers should ensure their devices have sufficient memory and confirm that current hardware and software configurations will continue to be supported by any new releases. For unclear information, customers are advised to contact Cisco Technical Assistance Center (TAC) or their maintenance providers.
Related
