Cisco Security Advisory
Click Icon to Copy Verbose Score
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:X/RL:X/RC:X
-
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x.
These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release.
The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory:
- CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution
- CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters
- CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits
- CVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addresses
For information about Splunk products and offerings, including AppDynamics, see Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026
This investigation was expanded to cover Brotli outside of Node.js on October 30, 2026. The Brotli decoder flaw (CVE-2026-111497), which is in the Google Brotli C decoder, is often bundled with or linked to other software, so products beyond Node.js may be affected. For software that may be affected, see Broccoli2Shell.
Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
This advisory will be updated as additional information becomes available.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u
-
Cisco is investigating its product line to determine which products may be affected by these vulnerabilities. As the investigation progresses, Cisco will update this advisory with information about affected products.
The Vulnerable Products section will include Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool and contain additional platform-specific information, including workarounds (if available) and fixed software releases.
Status of Cisco Priority Products
The following table lists Cisco priority products and the status of the investigation into the impact of the vulnerabilities that are described in this advisory.
Cisco Product Status Catalyst SD-WAN Software Not impacted Identity Services Engine (ISE) Not impacted IOS XE Software Not impacted IOS XR Software Not impacted NX-OS Software See the Impacted Products with Software Fixes and Products Confirmed Not Vulnerable tables Secure Firewall Adaptive Security Appliance (ASA) Software Not impacted Secure Firewall Management Center (FMC) Software Not impacted Secure Firewall Threat Defense (FTD) Not Impacted Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
Other Products Under Investigation
The following products are also under active investigation to determine whether they are affected by the vulnerabilities that are described in this advisory.
Network and Content Security Devices Cryptographic Services PureCA (Private PKI CA) Network Management and Provisioning BGP Traffic Engineering Controller Catalyst Center (formerly DNA Center) Crosswork Hierarchical Controller Routing and Switching - Enterprise and Service Provider Cloud Native Deployment Platform (CNDP) Enterprise NFV Infrastructure Software (NFVIS) NextFusion Platform Unified Computing HyperFlex HX Data Platform Cisco Cloud Hosted Services LMA Robust Intelligence RIME Secure Workload SaaS Security Cloud Sign On Smartlook Vulnerability Management (formerly Kenna.VM) Webex AI Agent Cisco Services CDT CX Cloud Managed Services Platform Readiness Assessment Tool for Cloud Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
Vulnerable Products
For information on the status of the investigation into the impact of these vulnerabilities on Cisco priority products, see the Status of Cisco Priority Products section.
Cisco is investigating its product line to determine which products may be affected by these vulnerabilities and the impact on each affected product. This section will be updated as information is available.
Impacted Products with Software Fixes
Cisco Product Cisco Bug ID Fixed Release Available Collaboration and Social Media AI PODs for Collaboration 1.0.2 (Nov 2026) Cable Devices Smart PHY CSCwx49006 Release no. TBD (Mar 2027) Endpoint Clients and Software Packet Tracer 9.2.0 (Dec 2026) Network and Content Security Devices Duo Network Gateway 3.4.2 Duo Authentication Proxy Local Manager for Windows 6.8.1 (Nov 2026) Hypershield Release no. TBD Secure Workload Release no. TBD (Feb 2027) Network Management and Provisioning Business Process Automation (BPA) CSCwx48997 5.0 (Nov 2026)
5.1 (Nov 2026)Common Services Platform Collector 2.11.0.9 (Nov 2026) Elastic Services Controller (ESC) 6.0.0.68 (Dec 2026) Optical Network Controller Release no. TBD Provider Connectivity Assurance Release no. TBD Secure Endpoint - Private Cloud Appliance CSCwx48980 Release no. TBD (Nov 2026) Virtualized Infrastructure Manager CSCwx48998 Release no. TBD Routing and Switching - Enterprise and Service Provider Nexus 3000 Series Switches in standalone NX-OS (Guest Shell) CSCwx56979 Guestshell 4.9 or the following fixed NX-OS Software releases:
9.3.19 (Jan 2027)
10.3.11 (Dec 2026)
10.4.9 (Feb 2027)
10.5.7 (Jan 2027)
10.6.5 (Feb 2027)
10.7.1 (Jan 2027)Nexus 9000 Series Switches in standalone NX-OS (Guest Shell) CSCwx56979 Guestshell 4.9 or the following fixed NX-OS Software releases:
9.3.19 (Jan 2027)
10.3.11 (Dec 2026)
10.4.9 (Feb 2027)
10.5.7 (Jan 2027)
10.6.5 (Feb 2027)
10.7.1 (Jan 2027)Private 5G CSCwx48976 22.23.4 (TBD) Ultra Cloud Core - Redundancy Configuration Manager Release no. TBD Unified Computing Intersight Virtual Appliance 1.1.8-2 (Nov 2026) Cisco Cloud Hosted Services AI Canvas 26.10.4 AppDynamics SaaS Release no. TBD Cloudlock Release no. TBD (Nov 2026) Intersight Release no. TBD (Nov 2026) Security Cloud Control 20261030-b3cffcb (Nov 2026) Spaces 24.22.1 ThousandEyes BrowserBot Cloud remediated - no customer action required. Webex Connect 6.22.2 (Nov 2026) Webex Contact Center 22.23.4/24.22.1 (Nov 2026) Cisco Services CLI Analyzer Release no. TBD IQ Link 1.3.1 (TBD) IQ Virtual Appliance 1.3.1 (TBD) Video, Streaming, TelePresence, and Transcoding Devices Collaboration Endpoints running RoomOS Software (Board, Desk, and Room Series) CSCwx44334 RoomOS On-premises:
11.41.2.3
26.7.4.3
RoomOS Cloud:
September 2026 / 26.9.1 and later for the current generation
11.41.1 and later for the previous generation.Voice and Unified Communications Devices Cloud Connect 15.0.SU3 - ES 202701 Wireless Connected Mobile Experiences (CMX) 11.2 (TBD) Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by these vulnerabilities.
Products Confirmed Not Vulnerable
For information on the status of the investigation into the impact of these vulnerabilities on Cisco priority products, see the Status of Cisco Priority Products section.
Cisco has confirmed that this issue does not affect the following Cisco products:
Cable Devices Intelligent Node Manager Endpoint Clients and Client Software Secure Client (formerly AnyConnect Secure Mobility Client) Network and Content Security Devices Cloud-Delivered Firewall Management Center (cdFMC) ISE Passive Identity Connector (ISE-PIC) Secure Firewall Adaptive Security Virtual Appliance (ASAv) Secure IPS, formerly Cisco Next-Generation Intrusion Prevention System (NGIPS) Secure Email Gateway Secure Malware Analytics - Private Cloud (Appliance) Secure Network Analytics Telemetry Broker Network Management and Provisioning Business Dashboard Catalyst SD-WAN Analytics Catalyst SD-WAN Controller Catalyst SD-WAN Portal Catalyst SD-WAN Manager Catalyst SD-WAN Validator Crosswork Workflow Manager Data Center Network Manager License (Smart Software Manager) On-Prem Mesh Policy Engine Optical Network Planner Nexus Dashboard SAN Insights Discovery ThousandEyes Enterprise Agent ThousandEyes Enterprise Agent - Cisco Application Hosting ThousandEyes Enterprise Agent - Linux Package Routing and Switching - Enterprise and Service Provider ASR 5000 Series Software (StarOS) Enterprise NFV Infrastructure Software (NFVIS) MDS 9000 Series Multilayer Switches Policy Suite (CPS) Ultra Cloud Core - Subscriber Microservices Infrastructure Nexus 7000 Series Switches Nexus 9000 Series Fabric Switches in ACI mode Cisco Cloud Hosted Services Duo IoT Control Center IoT Operations Dashboard Secure Access Secure Email Cloud Gateway Secure Email Threat Defense Umbrella CDaaS WG2 Webex Assistant for Meetings Webex Collaboration Control Hub Webex Calling Dedicated Instance Webex Interact Webex Meetings Vidcast Slido Webex Interact Cisco Services Business Critical Insights Secure Transfer Service Meraki Devices Meraki Dashboard Meraki MR Series Devices Meraki MS Series Devices Meraki MX Series Devices Unified Computing HyperFlex HX Data Platform UCS Software UCS Manager Software Wireless Industrial Wireless Monitor Video, Streaming, TelePresence, and Transcoding Devices Meeting Server Webex Desk Camera Voice and Unified Communications Devices Instant Messaging and Presence Service Unified Communications Manager Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.
-
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products section of this advisory.
-
For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products section of this advisory.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
-
The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerabilities described in this advisory.
The Cisco PSIRT is not aware of any malicious use of these vulnerabilities against any Cisco product.
-
These vulnerabilities were disclosed by Node.js.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
For additional information on Cisco's vulnerability management, disclosure cadence, and software patching strategy, see Cisco's Transition to a Risk-Based Vulnerability Disclosure Model.
-
Show LessVersion Description Section Status Date 1.13 Updated products under investigation, vulnerable products, and products confirmed not vulnerable. Summary and Affected Products Interim 2026-NOV-13 1.12 Updated summary, products under investigation, vulnerable products, and products confirmed not vulnerable. Affected Products Interim 2026-NOV-12 1.11 Updated products under investigation and vulnerable products. Affected Products Interim 2026-NOV-10 1.10 Updated products under investigation, vulnerable products, and products confirmed not vulnerable. Affected Products Interim 2026-NOV-10 1.9 Updated products under investigation, vulnerable products, and products confirmed not vulnerable. Affected Products Interim 2026-NOV-09 1.8 Updated products under investigation, vulnerable products, and products confirmed not vulnerable. Affected Products Interim 2026-NOV-06 1.7 Updated vulnerable products and products confirmed not vulnerable. Affected Products Interim 2026-NOV-05 1.6 Updated vulnerable products and products confirmed not vulnerable. Affected Products Interim 2026-NOV-04 1.5 Updated title, summary, vulnerable products, and products confirmed not vulnerable. Title, Summary, Affected Products Interim 2026-NOV-04 1.4 Updated vulnerable products and products confirmed not vulnerable. Affected Products Interim 2026-NOV-02 1.3 Updated vulnerable products and products confirmed not vulnerable. Affected Products Interim 2026-OCT-30 1.2 Updated vulnerable products and products confirmed not vulnerable. Affected Products Interim 2026-OCT-29 1.1 Updated vulnerable products and products confirmed not vulnerable. Added link to Splunk advisory. Summary and Affected Products Interim 2026-OCT-28 1.0 Initial public release. — Interim 2026-OCT-27
-
SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT
The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC). Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
When considering software upgrades, customers are advised to regularly consult the advisories for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
LEGAL DISCLAIMER DETAILS
CISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
Copies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy for more information.