Vulnerabilities in Node.js Affecting Cisco Products: October 2026
Cisco has identified multiple critical vulnerabilities in Node.js that could lead to remote code execution and traffic interception across several of its products.
On October 21, 2026, Node.js announced fixes for multiple vulnerabilities across its supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations including the Brotli decoder, DNS resolution, and TLS certificate validation, posing significant security risks for organizations using affected Cisco products.
The vulnerabilities have been assigned Security Impact Ratings (SIR) of High and include CVE-2026-111497, which involves a Brotli decoder out-of-bounds write that could lead to remote code execution. Other critical vulnerabilities include CVE-2026-105482 (DNS resolution truncation), CVE-2026-105483 (TLS hostname validation bypass using fullwidth IP digits), and CVE-2026-106069 (TLS hostname validation bypass with noncanonical IP addresses).
Investigation Status
Cisco is actively investigating its product line to determine which products may be affected by these vulnerabilities. The company has updated its advisory with information about affected products, including Cisco bug IDs for each impacted product. These bugs are accessible through the Cisco Bug Search Tool and contain additional platform-specific information, including workarounds and fixed software releases.
Several priority products are currently under investigation, including Catalyst SD-WAN Manager, Identity Services Engine (ISE), IOS Software, IOS XE Software, IOS XR Software, NX-OS Software, Secure Firewall Adaptive Security Appliance (ASA) Software, Secure Firewall Management Center (FMC) Software, and Secure Firewall Threat Defense (FTD).
If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
Confirmed Impacts
Cisco has confirmed that the Network Management and Provisioning product Catalyst Center is affected and has released a fixed version (10-202610) available through the Smart Software Manager. The company has also confirmed that the following products are not affected: Business Dashboard, Mesh Policy Engine, and Nexus Dashboard.
The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for these vulnerabilities. However, the team has not observed any malicious use of these vulnerabilities against Cisco products at this time.
Customer Actions
Customers are advised to regularly consult Cisco Security Advisories to determine their exposure and identify appropriate upgrade solutions. When considering software upgrades, customers should ensure that devices contain sufficient memory and confirm that current hardware and software configurations will continue to be supported by the new release.
Any available workarounds will be documented in the product-specific Cisco bugs identified in the Vulnerable Products section of the advisory. Customers seeking clarification on upgrade paths or workarounds are encouraged to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Related
