Vulnerabilities in Node.js Affecting Cisco Products: October 2026
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release . The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory: CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters CVE
Read at Cisco PSIRT Security Advisories
- Vendor
- Cisco, Node.js
- Product
- Node.js
- EPSS
- 0.83 (p100)
- Fix
- available
- Exposure class
- Developer platform
Why it ranks 53 (High)
- EPSS 0.83 (high probability of exploitation)
- Product class: developer platform
- Widely deployed vendor product (Cisco)
- Covered by 21 independent sources
- Fix available
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Cisco PSIRT Security Advisories (sec.cloudapps.cisco.com)
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-105482 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-105483 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-106069 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.