Vulnerabilities in node.js Affecting Cisco Products: October 2026

🚨SEVERITY: HIGH — CVSS 7.4Security Advisory

TL;DR 📌

  • On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x.  These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js…
  • Highest CVSS: 7.4 (High).
  • Listed in CISA KEV (2026-10-27) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-105482, CVE-2026-105483, CVE-2026-106069.

What it is

On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x.  These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release .  The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory:

CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits CVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addresses

Important: If a product is not listed within this advisory, Cisco’s review indicates that the product is not affected by this vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u

	           <br/>Security Impact Rating:  High

For leadership 🧭

Executive summary. Risk is High (CVSS 7.4) across any Cisco kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source