cisco-sa-oct2026-node-js-Jj3SQ19u: Vulnerabilities in node.js Affecting Cisco Products: October 2026

On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release. The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory:CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code executionCVE-2026-105482 - DNS resolution truncation involving embedded NUL charactersCVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digitsCVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addressesImportant: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.This advisory will be updated as additional information becomes available.This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u