Cisco warns October 2026 Node.js flaws can enable RCE
Original title: Vulnerabilities in Node.js Affecting Cisco Products: October 2026
High-SIR issues include a Brotli out-of-bounds write and DNS truncation with an embedded NUL; fixes cover 22.x, 24.x, and 26.x.
On October 21, 2026, Node.js published fixes for multiple vulnerabilities in supported lines 22.x, 24.x, and 26.x. Cisco says the flaws affect the Brotli decoder, DNS resolution, and TLS certificate validation and can lead to remote code execution or traffic interception in Cisco products that use Node.js. This advisory covers High Security Impact Rating issues, including CVE-2026-111497, a Brotli decoder out-of-bounds write, and CVE-2026-105482, DNS resolution truncation involving an embedded NUL. The feed text cuts off before listing every CVE or affected Cisco product.
Unconfirmed: The snippet does not name which Cisco products are affected or the exact fixed Node.js versions.
- Node.js announced fixes on October 21, 2026 for 22.x, 24.x, and 26.x.
- CVE-2026-111497 is a Brotli decoder out-of-bounds write with potential remote code execution.
- CVE-2026-105482 involves DNS resolution truncation with an embedded NUL.
- Cisco assigns these issues a High Security Impact Rating.
Impact: Potential remote code execution or interception of traffic
| Product | Affected |
|---|---|
| Node.js | 22.x, 24.x, and 26.x |
- 1.Apply the Node.js security fixes for the 22.x, 24.x, and 26.x lines used by affected Cisco products.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105482 | NUL-byte truncation in Node.js dns.resolve* and dns.reverse | 7.4 | <1% | PoC ×2 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
On October 21, 2026, Node. js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22. x, 24.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.