Cisco Security Advisory
Click Icon to Copy Verbose Score
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:X/RL:X/RC:X
-
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x.
These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release.
The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory:
- CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution
- CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters
- CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits
- CVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addresses
For information about Splunk products and offerings, see Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026
This investigation was expanded to cover Brotli outside of Node.js on October 30, 2026. The Brotli decoder flaw (CVE-2026-111497), which is in the Google Brotli C decoder, is often bundled with or linked to other software, so products beyond Node.js may be affected. For software that may be affected, see Broccoli2Shell.
Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
This advisory will be updated as additional information becomes available.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u
-
Cisco is investigating its product line to determine which products may be affected by these vulnerabilities. As the investigation progresses, Cisco will update this advisory with information about affected products.
The Vulnerable Products section will include Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool and contain additional platform-specific information, including workarounds (if available) and fixed software releases.
Status of Cisco Priority Products
The following table lists Cisco priority products and the status of the investigation into the impact of the vulnerabilities that are described in this advisory.
Cisco Product Status Catalyst SD-WAN Software Not impacted Identity Services Engine (ISE) Not impacted IOS XE Software Not impacted IOS XR Software Not impacted NX-OS Software See the Impacted Products with Software Fixes and Products Confirmed Not Vulnerable tables Secure Firewall Adaptive Security Appliance (ASA) Software Not impacted Secure Firewall Management Center (FMC) Software Not impacted Secure Firewall Threat Defense (FTD) Not Impacted Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
Other Products Under Investigation
The following products are also under active investigation to determine whether they are affected by the vulnerabilities that are described in this advisory.
Application Observability AppDynamics AppDynamics Enterprise Console AppDynamics Virtual Appliance Collaboration and Social Media AI PODs for Collaboration Network and Content Security Devices Cryptographic Services PureCA (Private PKI CA) Hypershield Network Management and Provisioning BGP Traffic Engineering Controller Crosswork Hierarchical Controller Crosswork Workflow Manager Elastic Services Controller (ESC) Optical Network Controller Provider Connectivity Assurance Routing and Switching - Enterprise and Service Provider ASR 5000 Series Software (StarOS) Cloud Native Deployment Platform (CNDP) Enterprise NFV Infrastructure Software (NFVIS) NextFusion Platform Policy Suite (CPS) Ultra Packet Core - Redundancy Configuration Manager (RCM) Unified Computing HyperFlex HX Data Platform Video, Streaming, TelePresence, and Transcoding Devices Webex Desk Camera Voice and Unified Communications Devices Cloud Connect Wireless Connected Mobile Experiences (CMX) Cisco Cloud Hosted Services Cloud Native Application Observability Cloudlock IoT Operations Dashboard LMA Robust Intelligence RIME Secure Workload SaaS Security Cloud Sign On Smartlook ThousandEyes Vidcast Vulnerability Management (formerly Kenna.VM) Webex AI Agent Webex Assistant for Meetings Webex Collaboration Control Hub Webex Contact Center Webex Integrations and Bots Webex Interact Cisco Services Business Critical Insights CDT CX Cloud IQ Managed Services Platform Readiness Assessment Tool for Cloud Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
Vulnerable Products
For information on the status of the investigation into the impact of these vulnerabilities on Cisco priority products, see the Status of Cisco Priority Products section.
Cisco is investigating its product line to determine which products may be affected by these vulnerabilities and the impact on each affected product. This section will be updated as information is available.
Impacted Products with Software Fixes
Cisco Product Cisco Bug ID Fixed Release Available Cable Devices Smart PHY CSCwx49006 Release no. TBD (Mar 2027) Endpoint Clients and Software Packet Tracer 9.2.0 (Dec 2026) Network and Content Security Devices Duo Network Gateway 3.4.2 Duo Authentication Proxy Local Manager for Windows 6.8.1 (Nov 2026) Secure Workload Release no. TBD Network Management and Provisioning Business Process Automation (BPA) CSCwx48997 4.1.2 (TBD)
5.0 (Nov 2026)
5.1 (TBD)Catalyst Center (formerly DNA Center) CSCwx48988 3.4.1 (July 2027) Secure Endpoint - Private Cloud Appliance CSCwx48980 Release no. TBD (Nov 2026) Virtualized Infrastructure Manager CSCwx48998 Release no. TBD Routing and Switching - Enterprise and Service Provider Nexus 9000 Series Switches in standalone NX-OS (Guest Shell) Release no. TBD Private 5G CSCwx48976 22.23.4 (TBD) Unified Computing Intersight Virtual Appliance Release no. TBD (Nov 2026) Cisco Cloud Hosted Services AI Canvas 26.10.4 AppDynamics SaaS Release no. TBD Security Cloud Control 20261030-b3cffcb (Nov 2026) Intersight Release no. TBD (Nov 2026) Spaces 24.22.1 Webex Connect 6.22.2 (Nov 2026) Cisco Services CLI Analyzer Release no. TBD Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by these vulnerabilities.
Products Confirmed Not Vulnerable
For information on the status of the investigation into the impact of these vulnerabilities on Cisco priority products, see the Status of Cisco Priority Products section.
Cisco has confirmed that this issue does not affect the following Cisco products:
Cable Devices Intelligent Node Manager Endpoint Clients and Client Software Secure Client (formerly AnyConnect Secure Mobility Client) Network and Content Security Devices Cloud-Delivered Firewall Management Center (cdFMC) ISE Passive Identity Connector (ISE-PIC) Secure Firewall Adaptive Security Virtual Appliance (ASAv) Secure IPS, formerly Cisco Next-Generation Intrusion Prevention System (NGIPS) Secure Malware Analytics - Private Cloud (Appliance) Secure Network Analytics Telemetry Broker Network Management and Provisioning Business Dashboard Catalyst SD-WAN Analytics Catalyst SD-WAN Controller Catalyst SD-WAN Portal Catalyst SD-WAN Manager Catalyst SD-WAN Validator Data Center Network Manager License (Smart Software Manager) On-Prem Mesh Policy Engine Optical Network Planner Nexus Dashboard SAN Insights Discovery ThousandEyes Enterprise Agent ThousandEyes Enterprise Agent - Cisco Application Hosting Routing and Switching - Enterprise and Service Provider MDS 9000 Series Multilayer Switches Ultra Cloud Core - Subscriber Microservices Infrastructure Nexus 7000 Series Switches Nexus 9000 Series Fabric Switches in ACI mode Cisco Cloud Hosted Services Duo IoT Control Center Secure Access Secure Email Cloud Gateway Secure Email Threat Defense Umbrella CDaaS WG2 Cisco Services Secure Transfer Service Meraki Devices Meraki Dashboard Meraki MR Series Devices Meraki MS Series Devices Meraki MX Series Devices Unified Computing UCS Software UCS Manager Software Wireless Industrial Wireless Monitor Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
-
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products section of this advisory.
-
For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products section of this advisory.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
-
The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerabilities described in this advisory.
The Cisco PSIRT is not aware of any malicious use of these vulnerabilities against any Cisco product.
-
These vulnerabilities were disclosed by Node.js.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
For additional information on Cisco's vulnerability management, disclosure cadence, and software patching strategy, see Cisco's Transition to a Risk-Based Vulnerability Disclosure Model.
-
Show LessVersion Description Section Status Date 1.7 Updated vulnerable products and products confirmed not vulnerable. Affected Products Interim 2026-NOV-05 1.6 Updated vulnerable products and products confirmed not vulnerable. Affected Products Interim 2026-NOV-04 1.5 Updated title, summary, vulnerable products, and products confirmed not vulnerable. Title, Summary, Affected Products Interim 2026-NOV-04 1.4 Updated vulnerable products and products confirmed not vulnerable. Affected Products Interim 2026-NOV-02 1.3 Updated vulnerable products and products confirmed not vulnerable. Affected Products Interim 2026-OCT-30 1.2 Updated vulnerable products and products confirmed not vulnerable. Affected Products Interim 2026-OCT-29 1.1 Updated vulnerable products and products confirmed not vulnerable. Added link to Splunk advisory. Summary and Affected Products Interim 2026-OCT-28 1.0 Initial public release. — Interim 2026-OCT-27
-
SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT
The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC). Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
When considering software upgrades, customers are advised to regularly consult the advisories for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
LEGAL DISCLAIMER DETAILS
CISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
Copies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy for more information.