{ "document": { "acknowledgments": [ { "summary": "These vulnerabilities were disclosed by Node.js." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "notes": [ { "category": "summary", "title": "Summary", "text": "On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x.\r\n\r\nThese vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release [\"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases\"].\r\n\r\nThe following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory:\r\n\r\nCVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution\r\nCVE-2026-105482 - DNS resolution truncation involving embedded NUL characters\r\nCVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits\r\nCVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addresses\r\n\r\nFor information about Splunk products and offerings, see Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026 [\"https://advisory.splunk.com/advisories/SVD-2026-1015\"]\r\n\r\nThis investigation was expanded to cover Brotli outside of Node.js on October 30, 2026. The Brotli decoder flaw (CVE-2026-111497), which is in the Google Brotli C decoder, is often bundled with or linked to other software, so products beyond Node.js may be affected. For software that may be affected, see Broccoli2Shell [\"https://broccoli2shell.com/\"].\r\n\r\nImportant: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.\r\n\r\nThis advisory will be updated as additional information becomes available.\r\n\r\n" }, { "category": "general", "title": "Affected Products", "text": "Cisco is investigating its product line to determine which products may be affected by these vulnerabilities. As the investigation progresses, Cisco will update this advisory with information about affected products.\r\n\r\nThe Vulnerable Products [\"#vp\"] section will include Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool [\"https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID\"] and contain additional platform-specific information, including workarounds (if available) and fixed software releases.\r\n\r\n Status of Cisco Priority Products\r\nThe following table lists Cisco priority products and the status of the investigation into the impact of the vulnerabilities that are described in this advisory.\r\n Cisco Product Status Catalyst SD-WAN Software Not impacted Identity Services Engine (ISE) Under Investigation IOS XE Software Not impacted IOS XR Software Not impacted NX-OS Software See the Impacted Products with Software Fixes and Products Confirmed Not Vulnerable tables Secure Firewall Adaptive Security Appliance (ASA) Software Not impacted Secure Firewall Management Center (FMC) Software Not impacted Secure Firewall Threat Defense (FTD) Not Impacted\r\nImportant: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.\r\n Other Products Under Investigation\r\nThe following products are also under active investigation to determine whether they are affected by the vulnerabilities that are described in this advisory.\r\n Application Observability AppDynamics AppDynamics Enterprise Console AppDynamics Virtual Appliance Network and Content Security Devices Cryptographic Services PureCA (Private PKI CA) Hypershield ISE Passive Identity Connector (ISE-PIC) Network Management and Provisioning BGP Traffic Engineering Controller Crosswork Hierarchical Controller Crosswork Workflow Manager Elastic Services Controller (ESC) Optical Network Controller Provider Connectivity Assurance Routing and Switching - Enterprise and Service Provider Cloud Native Deployment Platform (CNDP) Enterprise NFV Infrastructure Software (NFVIS) NextFusion Platform Ultra Packet Core - Redundancy Configuration Manager (RCM) Unified Computing HyperFlex HX Data Platform Video, Streaming, TelePresence, and Transcoding Devices Webex Desk Camera Wireless Connected Mobile Experiences (CMX) Cisco Cloud Hosted Services Cloud Native Application Observability Cloudlock IoT Operations Dashboard LMA Robust Intelligence RIME Secure Workload SaaS Security Cloud Sign On Smartlook ThousandEyes Vidcast Vulnerability Management (formerly Kenna.VM) Webex AI Agent Webex Assistant for Meetings Webex Collaboration Control Hub Webex Contact Center Webex Integrations and Bots Webex Interact Cisco Services CDT CX Cloud Managed Services Platform Readiness Assessment Tool for Cloud\r\nImportant: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability." }, { "category": "general", "title": "Vulnerable Products", "text": "For information on the status of the investigation into the impact of these vulnerabilities on Cisco priority products, see the Status of Cisco Priority Products [\"#priority\"] section.\r\n\r\nCisco is investigating its product line to determine which products may be affected by these vulnerabilities and the impact on each affected product. This section will be updated as information is available.\r\n\r\nImpacted Products with Software Fixes\r\n Cisco Product Cisco Bug ID Fixed Release Available Collaboration and Social Media AI PODs for Collaboration 1.0.2 (TBD) Cable Devices Smart PHY CSCwx49006 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx49006\"] Release no. TBD (Mar 2027) Endpoint Clients and Software Packet Tracer 9.2.0 (Dec 2026) Network and Content Security Devices Duo Network Gateway 3.4.2 Duo Authentication Proxy Local Manager for Windows 6.8.1 (Nov 2026) Secure Workload Release no. TBD (Feb 2027) Network Management and Provisioning Business Process Automation (BPA) CSCwx48997 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx48997\"] 4.1.2 (TBD)\r\n5.0 (Nov 2026)\r\n5.1 (TBD) Catalyst Center (formerly DNA Center) CSCwx48988 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx48988\"] 3.4.1 (July 2027) Common Services Platform Collector 2.11.0.9 (Nov 2026) Secure Endpoint - Private Cloud Appliance CSCwx48980 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx48980\"] Release no. TBD (Nov 2026) Virtualized Infrastructure Manager CSCwx48998 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx48998\"] Release no. TBD Routing and Switching - Enterprise and Service Provider Nexus 9000 Series Switches in standalone NX-OS (Guest Shell) Release no. TBD Private 5G CSCwx48976 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx48976\"] 22.23.4 (TBD) Unified Computing Intersight Virtual Appliance Release no. TBD (Nov 2026) Cisco Cloud Hosted Services AI Canvas 26.10.4 AppDynamics SaaS Release no. TBD Security Cloud Control 20261030-b3cffcb (Nov 2026) Intersight Release no. TBD (Nov 2026) Spaces 24.22.1 Webex Connect 6.22.2 (Nov 2026) Cisco Services CLI Analyzer Release no. TBD IQ Link 1.3.1 (TBD) IQ Virtual Appliance 1.3.1 (TBD) Video, Streaming, TelePresence, and Transcoding Devices Collaboration Endpoints running RoomOS Software (Board, Desk, and Room Series) CSCwx44334 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx44334\"] RoomOS On-premises:\r\n11.41.2.3\r\n26.7.4.3\r\n\r\nRoomOS Cloud:\r\nSeptember 2026 / 26.9.1 and later for the current generation\r\n11.41.1 and later for the previous generation. Voice and Unified Communications Devices Cloud Connect 15.0.SU3 - ES 202701\r\nImportant: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by these vulnerabilities." }, { "category": "general", "title": "Products Confirmed Not Vulnerable", "text": "For information on the status of the investigation into the impact of these vulnerabilities on Cisco priority products, see the Status of Cisco Priority Products [\"#priority\"] section.\r\n\r\nCisco has confirmed that this issue does not affect the following Cisco products:\r\n Cable Devices Intelligent Node Manager Endpoint Clients and Client Software Secure Client (formerly AnyConnect Secure Mobility Client) Network and Content Security Devices Cloud-Delivered Firewall Management Center (cdFMC) Secure Firewall Adaptive Security Virtual Appliance (ASAv) Secure IPS, formerly Cisco Next-Generation Intrusion Prevention System (NGIPS) Secure Malware Analytics - Private Cloud (Appliance) Secure Network Analytics Telemetry Broker Network Management and Provisioning Business Dashboard Catalyst SD-WAN Analytics Catalyst SD-WAN Controller Catalyst SD-WAN Portal Catalyst SD-WAN Manager Catalyst SD-WAN Validator Data Center Network Manager License (Smart Software Manager) On-Prem Mesh Policy Engine Optical Network Planner Nexus Dashboard SAN Insights Discovery ThousandEyes Enterprise Agent ThousandEyes Enterprise Agent - Cisco Application Hosting Routing and Switching - Enterprise and Service Provider ASR 5000 Series Software (StarOS) MDS 9000 Series Multilayer Switches Policy Suite (CPS) Ultra Cloud Core - Subscriber Microservices Infrastructure Nexus 7000 Series Switches Nexus 9000 Series Fabric Switches in ACI mode Cisco Cloud Hosted Services Duo IoT Control Center Secure Access Secure Email Cloud Gateway Secure Email Threat Defense Umbrella CDaaS WG2 Cisco Services Business Critical Insights Secure Transfer Service Meraki Devices Meraki Dashboard Meraki MR Series Devices Meraki MS Series Devices Meraki MX Series Devices Unified Computing UCS Software UCS Manager Software Wireless Industrial Wireless Monitor\r\nImportant: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability." }, { "category": "general", "title": "Workarounds", "text": "Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products [\"#vp\"] section of this advisory." }, { "category": "general", "title": "Fixed Software", "text": "For information about fixed software releases [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], consult the Cisco bugs identified in the Vulnerable Products [\"#vp\"] section of this advisory.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page, to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers." }, { "category": "general", "title": "Vulnerability Policy", "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.\r\n\r\nFor additional information on Cisco's vulnerability management, disclosure cadence, and software patching strategy, see Cisco's Transition to a Risk-Based Vulnerability Disclosure Model [\"https://sec.cloudapps.cisco.com/security/center/resources/risk-based-disclosure\"]." }, { "category": "general", "title": "Exploitation and Public Announcements", "text": "The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerabilities described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of these vulnerabilities against any Cisco product." }, { "category": "general", "title": "Source", "text": "These vulnerabilities were disclosed by Node.js." }, { "category": "legal_disclaimer", "title": "Legal Disclaimer", "text": "SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT\r\n\r\nThe Cisco Support and Downloads [\"https://www.cisco.com/c/en/us/support/index.html\"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.\r\n\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories [\"https://www.cisco.com/go/psirt\"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"] or their contracted maintenance providers.\r\nLEGAL DISCLAIMER DETAILS\r\n\r\nCISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nCopies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] for more information." } ], "publisher": { "category": "vendor", "contact_details": "psirt@cisco.com", "issuing_authority": "Cisco PSIRT", "name": "Cisco", "namespace": "https://wwww.cisco.com" }, "references": [ { "category": "self", "summary": "Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u" }, { "category": "external", "summary": "Cisco Security Vulnerability Policy", "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html" }, { "category": "external", "summary": "Node.js Security Release", "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases" }, { "category": "external", "summary": "Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026", "url": "https://advisory.splunk.com/advisories/SVD-2026-1015" }, { "category": "external", "summary": "Broccoli2Shell", "url": "https://broccoli2shell.com/" }, { "category": "external", "summary": "Cisco Bug Search Tool", "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID" }, { "category": "external", "summary": "CSCwx49006", "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx49006" }, { "category": "external", "summary": "CSCwx48997", "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx48997" }, { "category": "external", "summary": "CSCwx48988", "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx48988" }, { "category": "external", "summary": "CSCwx48980", "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx48980" }, { "category": "external", "summary": "CSCwx48998", "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx48998" }, { "category": "external", "summary": "CSCwx48976", "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx48976" }, { "category": "external", "summary": "CSCwx44334", "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwx44334" }, { "category": "external", "summary": "fixed software releases", "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes" }, { "category": "external", "summary": "Cisco Security Advisories", "url": "https://www.cisco.com/go/psirt" }, { "category": "external", "summary": "Security Vulnerability Policy", "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html" }, { "category": "external", "summary": "Cisco's Transition to a Risk-Based Vulnerability Disclosure Model", "url": "https://sec.cloudapps.cisco.com/security/center/resources/risk-based-disclosure" }, { "category": "external", "summary": "Cisco Support and Downloads", "url": "https://www.cisco.com/c/en/us/support/index.html" }, { "category": "external", "summary": "Cisco Technical Assistance Center (TAC)", "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html" } ], "title": "Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026", "tracking": { "current_release_date": "2026-11-06T20:17:59+00:00", "generator": { "date": "2026-11-06T20:18:14+00:00", "engine": { "name": "TVCE" } }, "id": "cisco-sa-oct2026-node-js-Jj3SQ19u", "initial_release_date": "2026-10-27T21:30:00+00:00", "revision_history": [ { "date": "2026-10-27T21:25:37+00:00", "number": "1.0.0", "summary": "Initial public release." }, { "date": "2026-10-28T20:36:45+00:00", "number": "1.1.0", "summary": "Updated vulnerable products and products confirmed not vulnerable. Added link to Splunk advisory." }, { "date": "2026-10-29T20:24:20+00:00", "number": "1.2.0", "summary": "Updated vulnerable products and products confirmed not vulnerable." }, { "date": "2026-10-30T19:55:59+00:00", "number": "1.3.0", "summary": "Updated vulnerable products and products confirmed not vulnerable." }, { "date": "2026-11-02T21:16:10+00:00", "number": "1.4.0", "summary": "Updated vulnerable products and products confirmed not vulnerable." }, { "date": "2026-11-04T18:52:10+00:00", "number": "1.5.0", "summary": "Updated title, summary, vulnerable products, and products confirmed not vulnerable." }, { "date": "2026-11-05T00:32:39+00:00", "number": "1.6.0", "summary": "Updated vulnerable products and products confirmed not vulnerable." }, { "date": "2026-11-05T15:22:45+00:00", "number": "1.7.0", "summary": "Updated vulnerable products and products confirmed not vulnerable." }, { "date": "2026-11-06T20:17:59+00:00", "number": "1.8.0", "summary": "Updated products under investigation, vulnerable products, and products confirmed not vulnerable." } ], "status": "interim", "version": "1.8.0" } }, "product_tree": { "branches": [ { "name": "Cisco", "category": "vendor", "branches": [ { "name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software", "category": "product_family", "product": { "name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software ", "product_id": "CSAFPID-6588" } }, { "name": "Cisco NX-OS Software", "category": "product_family", "product": { "name": "Cisco NX-OS Software ", "product_id": "CSAFPID-80720" } }, { "name": "Cisco Identity Services Engine Software", "category": "product_family", "product": { "name": "Cisco Identity Services Engine Software ", "product_id": "CSAFPID-111903" } }, { "name": "Cisco Secure Firewall Management Center (FMC)", "category": "product_family", "product": { "name": "Cisco Secure Firewall Management Center (FMC) ", "product_id": "CSAFPID-212162" } }, { "name": "Cisco Secure Firewall Threat Defense (FTD) Software", "category": "product_family", "product": { "name": "Cisco Secure Firewall Threat Defense (FTD) Software ", "product_id": "CSAFPID-220203" } }, { "name": "Cisco Secure Endpoint", "category": "product_family", "product": { "name": "Cisco Secure Endpoint ", "product_id": "CSAFPID-221075" } }, { "name": "Cisco Firepower Extensible Operating System (FXOS)", "category": "product_family", "product": { "name": "Cisco Firepower Extensible Operating System (FXOS) ", "product_id": "CSAFPID-225888" } }, { "name": "Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Data Center Network Manager (DCNM)", "category": "product_family", "product": { "name": "Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Data Center Network Manager (DCNM) ", "product_id": "CSAFPID-233075" } }, { "name": "Cisco Catalyst Center", "category": "product_family", "product": { "name": "Cisco Catalyst Center ", "product_id": "CSAFPID-233151" } }, { "name": "Cisco License On-Prem", "category": "product_family", "product": { "name": "Cisco License On-Prem ", "product_id": "CSAFPID-274027" } }, { "name": "Cisco AppDynamics", "category": "product_family", "product": { "name": "Cisco AppDynamics ", "product_id": "CSAFPID-286296" } }, { "name": "Cisco Virtualized Infrastructure Manager", "category": "product_family", "product": { "name": "Cisco Virtualized Infrastructure Manager ", "product_id": "CSAFPID-286444" } }, { "name": "Cisco CloudCenter", "category": "product_family", "product": { "name": "Cisco CloudCenter ", "product_id": "CSAFPID-286499" } }, { "name": "Cisco ISE Passive Identity Connector", "category": "product_family", "product": { "name": "Cisco ISE Passive Identity Connector ", "product_id": "CSAFPID-292424" } }, { "name": "Cisco Secure Endpoint Private Cloud Administration Portal", "category": "product_family", "product": { "name": "Cisco Secure Endpoint Private Cloud Administration Portal ", "product_id": "CSAFPID-292706" } }, { "name": "Cisco Secure Endpoint Private Cloud Console", "category": "product_family", "product": { "name": "Cisco Secure Endpoint Private Cloud Console ", "product_id": "CSAFPID-292710" } }, { "name": "Cisco Secure Malware Analytics", "category": "product_family", "product": { "name": "Cisco Secure Malware Analytics ", "product_id": "CSAFPID-295422" } }, { "name": "Cisco Smart License Utility", "category": "product_family", "product": { "name": "Cisco Smart License Utility ", "product_id": "CSAFPID-302755" } } ] } ] }, "vulnerabilities": [ { "cve": "CVE-2026-106069", "notes": [ { "category": "other", "title": "Affected Product Comprehensiveness", "text": "Complete." } ], "product_status": { "known_affected": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ] }, "release_date": "2026-11-05T13:35:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "Cisco has released software updates that address this vulnerability.", "product_ids": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ], "url": "https://software.cisco.com" } ], "scores": [ { "cvss_v3": { "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ] } ], "title": "Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026" }, { "cve": "CVE-2026-105482", "notes": [ { "category": "other", "title": "Affected Product Comprehensiveness", "text": "Complete." } ], "product_status": { "known_affected": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ] }, "release_date": "2026-11-05T13:35:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "Cisco has released software updates that address this vulnerability.", "product_ids": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ], "url": "https://software.cisco.com" } ], "scores": [ { "cvss_v3": { "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ] } ], "title": "Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026" }, { "cve": "CVE-2026-105483", "notes": [ { "category": "other", "title": "Affected Product Comprehensiveness", "text": "Complete." } ], "product_status": { "known_affected": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ] }, "release_date": "2026-11-05T13:35:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "Cisco has released software updates that address this vulnerability.", "product_ids": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ], "url": "https://software.cisco.com" } ], "scores": [ { "cvss_v3": { "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ] } ], "title": "Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026" }, { "cve": "CVE-2026-111497", "notes": [ { "category": "other", "title": "Affected Product Comprehensiveness", "text": "Complete." } ], "product_status": { "known_affected": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ] }, "release_date": "2026-11-05T13:35:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "Cisco has released software updates that address this vulnerability.", "product_ids": [ "CSAFPID-111903", "CSAFPID-292424", "CSAFPID-295422", "CSAFPID-233075", "CSAFPID-80720", "CSAFPID-302755", "CSAFPID-274027", "CSAFPID-286499", "CSAFPID-286444", "CSAFPID-220203", "CSAFPID-212162", "CSAFPID-6588", "CSAFPID-225888", "CSAFPID-286296", "CSAFPID-233151", "CSAFPID-292706", "CSAFPID-292710", "CSAFPID-221075" ], "url": "https://software.cisco.com" } ], "title": "Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026" } ] }