October 2026 Node.js flaws affect Cisco products, Cisco says
Original title: Vulnerabilities in node.js Affecting Cisco Products: October 2026
High-rated issues include a Brotli out-of-bounds write that could allow remote code execution.
Cisco says that on October 21, 2026, Node.js published fixes for multiple vulnerabilities in supported release lines 22.x, 24.x, and 26.x, and that those issues affect Cisco products. The flaws involve the Brotli decoder, DNS resolution, and TLS certificate validation, with risks of remote code execution and traffic interception. Cisco rates CVE-2026-111497 and CVE-2026-105482 as High. The feed text cuts off during the DNS issue description.
Unconfirmed: The snippet does not name fixed Node.js versions, list affected Cisco products, or say whether the flaws are exploited.
- CVE-2026-111497 is a Brotli decoder out-of-bounds write with potential remote code execution.
- CVE-2026-105482 concerns DNS resolution truncation involving an embedded NUL.
- Fixes were announced for Node.js lines 22.x, 24.x, and 26.x.
- Cisco points readers to the Node.js security release for details.
Impact: Remote code execution or interception of traffic
| Product | Affected |
|---|---|
| Node.js | 22.x, 24.x, and 26.x |
| Cisco products using Node.js | — |
- 1.Apply the Node.js security fixes for release lines 22.x, 24.x, and 26.x.
- 2.Review Cisco’s October 2026 advisory for affected products.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105482 | NUL-byte truncation in Node.js dns.resolve* and dns.reverse | 7.4 | <1% | PoC ×2 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
On October 21, 2026, Node. js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22. x, 24.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.