Node.js Vulnerabilities Impacting Cisco Products – Immediate Action Required

What happened

On October 21 2026, the Node.js project released security patches for four high‑severity vulnerabilities that affect the supported 22.x, 24.x, and 26.x release lines. The advisory lists CVE‑2026‑111497, CVE‑2026‑105482, CVE‑2026‑105483, and CVE‑2026‑106069 as the affected issues.

These flaws touch core Node.js functionality: an out‑of‑bounds write in the Brotli decoder, a DNS resolution truncation that can be triggered with embedded NUL characters, and two TLS hostname validation bypasses that allow attackers to use fullwidth IP digits or noncanonical IP addresses to subvert certificate checks.

Who is affected

Cisco products that embed Node.js 22.x, 24.x, or 26.x are impacted. This includes any Cisco application or service that relies on the Node.js runtime for its web interface, API layer, or internal tooling. The advisory explicitly states that products not listed are not affected.

Defenders should inventory all Cisco deployments that use Node.js, noting the exact runtime version and whether the vulnerable modules are in use. Even legacy or custom‑built services that depend on Node.js can be exposed if they run an affected release line.

Impact

Remote code execution is possible via the Brotli decoder flaw when an attacker can supply a crafted compressed payload. The DNS truncation vulnerability can be leveraged to manipulate name resolution, potentially redirecting traffic or bypassing security controls.

The TLS hostname validation bypasses allow attackers to present certificates that do not match the intended hostname, enabling man‑in‑the‑middle attacks or credential theft. Because these issues are in core modules, the impact is broad and can affect any network traffic that passes through the vulnerable Node.js instance.

Exposure

Exploitation requires an attacker to deliver a malicious payload to the vulnerable component. For the Brotli issue, this could be a specially crafted HTTP request that includes a compressed body. DNS truncation can be triggered by sending DNS queries with embedded NUL characters, while TLS bypasses can be exercised during the TLS handshake by using noncanonical IP representations.

Since the vulnerabilities are in widely used Node.js modules, attackers can target any exposed service that runs the affected runtime. The lack of input validation in these modules means that the attack surface is large, especially for publicly reachable APIs or web interfaces.

What to do

Defenders must immediately update the Node.js runtime to the patched version for the affected release lines. The following actions are recommended:

• Verify the current Node.js version on all Cisco devices and services.
• Apply the official Node.js security patches for 22.x, 24.x, and 26.x.
• Re‑build or redeploy any custom applications that depend on Node.js to ensure the new runtime is in use.
• Run vulnerability scanners against the updated environment to confirm that the CVEs are no longer present.
• Implement runtime monitoring to detect anomalous DNS queries, TLS handshakes, or Brotli decompression errors.
• Review and tighten firewall rules to limit inbound traffic to only necessary ports and protocols.

What to watch

Keep abreast of any new Node.js advisories or CVE updates that may surface related to these modules. Cisco will issue follow‑up advisories if additional affected products are identified.

Monitor network traffic for signs of DNS truncation attempts, unusual TLS handshake patterns, or repeated Brotli decompression failures. These indicators can signal that an attacker is probing for the vulnerabilities before attempting exploitation.