Cisco Warns of High-Severity Node.js Vulnerabilities Affecting Multiple Products

Cisco Investigates Node.js Security Vulnerabilities

Cisco has published a high-severity security advisory warning customers about four vulnerabilities in Node.js that could affect multiple Cisco products.

The advisory, first published on October 27, 2026, and updated on October 30, identifies security issues affecting the Brotli decoder, DNS resolution and TLS certificate hostname validation.

The vulnerabilities were originally addressed by the Node.js project on October 21, 2026, across supported release lines 22.x, 24.x and 26.x.

Cisco is assessing its product portfolio to determine which systems are affected and what software updates are required. The company has also confirmed that proof-of-concept exploit code is available for the vulnerabilities.

However, Cisco's Product Security Incident Response Team (PSIRT) has not identified malicious exploitation of these vulnerabilities against Cisco products.

The advisory currently carries a High Security Impact Rating (SIR).

Four Node.js Vulnerabilities Identified

The advisory identifies four vulnerabilities that affect different security-critical components of Node.js.

Understanding the vulnerabilities

CVE-2026-111497: Brotli decoder out-of-bounds write

This vulnerability affects the Brotli decoder, a component responsible for decompressing Brotli-encoded data.

An out-of-bounds write occurs when software writes data outside the intended memory boundary. Depending on the circumstances, this type of memory corruption can create opportunities for remote code execution.

CVE-2026-105482: DNS resolution truncation

This vulnerability involves DNS resolution behaviour when domain-related input contains embedded NUL characters.

NUL characters can cause differences in how strings are interpreted or processed. In this case, the reported issue can result in DNS resolution truncation.

CVE-2026-105483: TLS hostname validation bypass

This vulnerability involves the use of fullwidth IP digits during TLS hostname validation.

TLS hostname validation helps ensure that a client connects to the intended server. A bypass can weaken this verification process.

CVE-2026-106069: TLS hostname validation bypass with noncanonical IP addresses

This issue involves noncanonical IP address representations that can affect hostname validation.

Both TLS-related vulnerabilities highlight the importance of consistent IP address parsing and hostname verification when establishing secure connections.

Cisco classifies all four vulnerabilities as high impact in this advisory.

Cisco Products Under Investigation

Cisco is reviewing its product portfolio to determine which products are affected by the four Node.js vulnerabilities.

As of the October 30, 2026, advisory update, several major product families remain under investigation.

These include:

Cisco has also listed products across networking, security, collaboration, cloud services, unified computing and application observability for further assessment.

The investigation includes products such as AppDynamics, Hypershield, UCS Software, HyperFlex HX Data Platform, ThousandEyes Enterprise Agent, Umbrella and several Webex services.

Important: Being listed under investigation does not confirm that a product is vulnerable. Cisco is still assessing the impact and will update the advisory as more information becomes available.

Products With Identified Software Fixes

Cisco has identified several products with available or planned software fixes in its October 30 advisory.

The published information includes the following products:

Other products listed include Secure Workload, Packet Tracer, AI Canvas, Security Cloud Control and CLI Analyzer. Specific fixed-release information is not yet fully available for these entries.

Cisco advises customers to consult the relevant Cisco bug records for product-specific information and confirmed software releases.

Cisco Products Confirmed Not Vulnerable

The advisory also identifies products that Cisco has confirmed are not affected by these vulnerabilities.

The confirmed list in the October 30 update includes:

• Secure Client, formerly AnyConnect Secure Mobility Client.

• Secure Malware Analytics - Private Cloud Appliance.

• Secure Network Analytics.

• Business Dashboard.

• Data Center Network Manager.

• License (Smart Software Manager) On-Prem.

• Mesh Policy Engine.

• Nexus Dashboard.

• SAN Insights Discovery.

• Duo.

• IoT Control Center.

• Secure Email Cloud Gateway.

• Meraki Dashboard.

• Meraki MR Series Devices.

• Meraki MS Series Devices.

• Meraki MX Series Devices.

This distinction is important for administrators. Cisco advises that products not listed in the advisory are considered unaffected based on its review. Customers should continue checking the latest advisory because the investigation remains ongoing.

Workarounds and Recommended Security Actions

Cisco's advisory explicitly states that no general workarounds are available.

Any product-specific workarounds will be documented in the corresponding Cisco bug records.

Until the investigation is complete, organisations using Cisco products should take a structured approach to vulnerability management.

Recommended administrative actions include:

1. Identify deployed Cisco products

Maintain an inventory of Cisco hardware, software and cloud services used across the organisation.

Compare deployed products with the lists in the latest security advisory.

2. Review product-specific vulnerability information

Check the Cisco Bug Search Tool for relevant bug IDs and additional information about affected releases, fixes and workarounds.

3. Monitor software update availability

Track the release information published by Cisco. Do not assume that a planned release date means a fix is already available.

4. Plan software upgrades

Before upgrading, verify hardware compatibility, memory requirements and support for existing configurations.

5. Follow advisory revisions

Cisco has already updated the advisory several times since its initial publication. Security teams should monitor subsequent changes rather than relying on an older copy.

6. Contact Cisco support when necessary

Cisco recommends contacting its Technical Assistance Center (TAC) or contracted maintenance providers when software upgrade information is unclear.

Proof-of-Concept Exploit Code Available

One of the most important details in Cisco's advisory is the availability of proof-of-concept (PoC) exploit code for the four vulnerabilities.

PoC code demonstrates how a vulnerability may be triggered or exploited under certain conditions. Its availability increases the importance of timely vulnerability assessment and patch management.

However, Cisco makes an important distinction regarding exploitation activity.

Its Product Security Incident Response Team is aware of the available PoC code but is not aware of malicious use of these vulnerabilities against any Cisco product.

This means organisations should treat the vulnerabilities seriously without assuming that successful attacks against Cisco products have been confirmed.

Cisco has not disclosed additional incident details in this advisory.

What This Means for Enterprise Security Teams

The Cisco advisory highlights how vulnerabilities in widely used software components can have implications beyond the original software ecosystem.

Node.js is used in application development and software environments. When vulnerabilities affect components such as data decompression, DNS resolution and TLS validation, vendors must assess whether their products incorporate the affected code.

For enterprises, this could mean reviewing not only directly deployed Node.js applications but also the software products and services that depend on Node.js internally.

The situation also demonstrates why vulnerability management requires continuous monitoring. A product initially listed for investigation may later receive a confirmed status, fixed release or updated remediation guidance.

These are broader operational considerations based on the announcement, not additional Cisco security claims.

Conclusion

Cisco's October 2026 security advisory identifies four high-severity Node.js vulnerabilities that could affect multiple products across its portfolio.

The reported issues involve Brotli decoder memory handling, DNS resolution and TLS hostname validation. Potential consequences include remote code execution and traffic interception.

Cisco has published product-specific fix information for several products, confirmed that others are unaffected and continues investigating additional systems.

Although proof-of-concept exploit code is available, Cisco has not identified malicious exploitation against its products.

Organisations should review their Cisco deployments, consult the latest advisory and follow product-specific software update guidance as Cisco publishes further findings.