Node.js vulnerabilities affecting Cisco products fixed in October 2026
Original title: Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026
Node.js 22.x, 24.x, and 26.x releases address multiple vulnerabilities including Brotli decoder out-of-bounds write and DNS resolution issues.
Node.js announced fixes for vulnerabilities in supported release lines 22.x, 24.x, and 26.x. These include Brotli decoder out-of-bounds write (CVE-2026-111497) and DNS resolution truncation. The issues pose risks for remote code execution and traffic interception.
- Fixes for Node.js 22.x, 24.x, 26.x
- CVE-2026-111497: Brotli decoder out-of-bounds write
- Potential remote code execution
- Impacts Cisco products
Impact: Remote code execution and traffic interception
- 1.Upgrade to fixed Node.js versions
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105482 | NUL-byte truncation in Node.js dns.resolve* and dns.reverse | 7.4 | <1% | PoC ×2 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
On October 21, 2026, Node. js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22. x, 24.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.