Cisco is investigating its product line to determine which products may end up affected in the multiple Node.js vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x.
To that end, updates are now available for the 26.x, 24.x, 22.x Node.js release lines.
These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release.
- CVE-2026-111497: Brotli decoder out-of-bounds write; potential remote code execution. A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer.
- CVE-2026-105482: DNS resolution truncation involving embedded NUL characters. A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().
- CVE-2026-105483: TLS hostname validation bypass using fullwidth IP digits. A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host ends up written with non-ASCII characters, such as fullwidth digits (１２７.0.0.1).
- CVE-2026-106069: TLS hostname validation bypass with noncanonical IP addresses. A flaw in Node.js TLS hostname verification can cause a server certificate to validate against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1.
For information about Splunk products and offerings, click on Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products – October 2026.
Expanded Investigation
This investigation expanded to cover Brotli outside of Node.js on October 30. The Brotli decoder flaw (CVE-2026-111497), which is in the Google Brotli C decoder, often bundles with or links to other software, so products beyond Node.js may end up affected.
This advisory will update as additional information becomes available.
Cisco is investigating its product line to determine which products may suffer from these vulnerabilities. As the investigation progresses, Cisco will update this advisory with information about affected products.
The following chart includes impacted Cisco products with software fixes:
Cisco Product Security Incident Response Team (PSIRT) is aware proof-of-concept exploit code is available for the vulnerabilities described in this advisory.
The Cisco PSIRT is not aware of any malicious use of these vulnerabilities against any Cisco product.
Click here for additional information on other Cisco security updates.