CompTIAAvailable
CS0-003
Node.js and Brotli Flaws in Cisco Products: October 2026
Cisco rated four Node.js and Brotli flaws High, including a Brotli decoder out-of-bounds write that could allow remote code execution. Several Cisco products have fixes scheduled, and many are still under investigation.
Short answer: Cisco published advisory cisco-sa-oct2026-node-js-Jj3SQ19u for four High-rated flaws in Node.js and the Google Brotli C decoder, with a base CVSS score of 7.4. Core platforms like IOS XE, IOS XR, ASA, FMC and FTD are listed as not impacted, while other products have fixes due between November 2026 and July 2027. Cisco says no workarounds are available, so track the advisory and patch listed products as fixes ship.
Cisco says four High-rated vulnerabilities in Node.js and the Brotli decoder affect some of its products, and no workarounds are available. The advisory is cisco-sa-oct2026-node-js-Jj3SQ19u. Fixes are scheduled for several products, and many others are still under investigation.
What happened
On October 21, 2026, Node.js announced fixes for multiple vulnerabilities in the supported release lines 22.x, 24.x, and 26.x. The flaws touch the Brotli decoder, DNS resolution, and TLS certificate validation. Cisco says they pose risks for remote code execution and traffic interception.
Cisco first published its advisory on October 27, 2026. On October 30, 2026, it widened the investigation to cover Brotli outside of Node.js. The latest version we reviewed is 1.8, updated November 6, 2026. You can read it in the Cisco advisory.
Splunk products are covered separately. Cisco points Splunk users to its advisory titled "Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026".
The four CVEs in plain terms
CVE | What it is |
|---|---|
CVE-2026-111497 | Brotli decoder out-of-bounds write; potential remote code execution |
CVE-2026-105482 | DNS resolution truncation involving embedded NUL characters |
CVE-2026-105483 | TLS hostname validation bypass using fullwidth IP digits |
CVE-2026-106069 | TLS hostname validation bypass with noncanonical IP addresses |
The Brotli flaw is in the Google Brotli C decoder. Cisco notes that this decoder is often bundled with or linked to other software. So products beyond Node.js may be affected.
The two TLS flaws matter for a simple reason. If hostname checks fail, a client may trust a certificate for the wrong IP address. That is how traffic interception becomes possible.
Who is affected
Cisco is still working through its product line. It will add Cisco bug IDs for each affected product in the Vulnerable Products section. Cisco also states that if a product is not listed in the advisory, its review indicates the product is not affected.
Priority products
Product | Status |
|---|---|
Catalyst SD-WAN Software | Not impacted |
Identity Services Engine (ISE) | Under investigation |
IOS XE Software | Not impacted |
IOS XR Software | Not impacted |
NX-OS Software | See the advisory's impacted and not-vulnerable tables |
Secure Firewall ASA Software | Not impacted |
Secure Firewall Management Center (FMC) | Not impacted |
Secure Firewall Threat Defense (FTD) | Not impacted |
Products with fixes listed
The table below shows what Cisco listed at the time of writing. Some entries are cut off in the version we reviewed, so check the advisory for the full list.
Product | Bug ID | Fixed release |
|---|---|---|
AI PODs for Collaboration | Not listed | 1.0.2 (TBD) |
Smart PHY | CSCwx49006 | Release no. TBD (Mar 2027) |
Packet Tracer | Not listed | 9.2.0 (Dec 2026) |
Duo Network Gateway | Not listed | 3.4.2 |
Duo Authentication Proxy Local Manager for Windows | Not listed | 6.8.1 (Nov 2026) |
Secure Workload | Not listed | Release no. TBD (Feb 2027) |
Business Process Automation (BPA) | CSCwx48997 | 4.1.2 (TBD), 5.0 (Nov 2026), 5.1 (TBD) |
Catalyst Center (formerly DNA Center) | CSCwx48988 | 3.4.1 (July 2027) |
Common Services Platform Collector | Not listed | 2.11.0.9 (Nov 2026) |
Cisco also lists many products as under investigation. They include AppDynamics, Crosswork Hierarchical Controller, NFVIS, HyperFlex HX Data Platform, Webex Contact Center, ThousandEyes, and more. Check the advisory for the complete list.
How serious it is
Cisco rates the advisory High. The base CVSS score is 7.4, with the vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. That means network reachable, high attack complexity, no privileges, and no user interaction. Impact is high for confidentiality and integrity.
The advisory text we reviewed does not mention active exploitation. Confirm the current status on the advisory page before you set your priority.
Two points shape your risk:
The Brotli bug could allow remote code execution, so internet-facing services that decode untrusted Brotli data deserve attention first.
The TLS bugs mostly matter where Node.js code connects to services by IP address.
What to do now
Cisco states there are no workarounds. Your main levers are inventory, patching, and exposure reduction.
Compare your Cisco inventory against the advisory's Vulnerable Products section.
Note the Cisco bug ID for each affected product. Use the Bug Search Tool links in the Cisco advisory to find platform-specific details and fixed releases.
Schedule upgrades where a fixed release exists, such as Duo Authentication Proxy Local Manager for Windows 6.8.1 or Packet Tracer 9.2.0.
For products with a TBD date, consider restricting network access to management and API interfaces until a fix ships. This is general hardening advice from us, not a Cisco-documented workaround.
Re-check the advisory often. Cisco says it will update it as more information becomes available.
Check your own Node.js exposure
The advisory covers Cisco products. Your own servers may run Node.js too. These commands show which version you have:
node --version
node -p "process.versions"The versions output includes a brotli entry. Use it to see which Brotli build your Node.js ships with.
To find Node.js projects and bundled Brotli libraries on a Linux host:
find / -name package.json -path "*node_modules*" -prune -o -name package.json -print 2>/dev/null | head
find / \( -name "libbrotlidec*" -o -name "libbrotlicommon*" \) 2>/dev/nullOn Debian or Ubuntu, check which packages depend on the library:
apt-cache rdepends --installed libbrotli1Compare any version you find with the fixed releases in the Node.js Security Release linked from the Cisco advisory. Fixes cover the 22.x, 24.x, and 26.x lines.
A worked example
Say you run Duo Authentication Proxy Local Manager for Windows, plus Cisco ISE. Duo's fixed version is 6.8.1, listed for November 2026, so you plan that upgrade. ISE is under investigation, so you consider limiting who can reach its admin interfaces and watch the advisory for a bug ID. You act on what is confirmed and track the rest.
What IT and security learners can take from this
This advisory shows how one library flaw spreads through many vendors. A bundled decoder can put you at risk even when you never installed Node.js. Learning to map dependencies, read CVSS vectors, and track vendor advisories is core work for security analysts.
If you are building those skills, the SC-900 voucher covers security, compliance, and identity fundamentals. For a related Cisco case, see our Cisco ISE authorization bypass fix guide.
Sources
Questions about this topic
Are IOS XE and Cisco firewalls affected by these Node.js flaws?
Cisco lists IOS XE, IOS XR, Catalyst SD-WAN, Secure Firewall ASA, FMC, and FTD as not impacted. NX-OS has its own entry in the advisory tables. ISE is still under investigation.
Is there a workaround if no patch exists for my product yet?
Cisco states that no workarounds are available. Limiting network access to management and API interfaces is general hardening advice from this article, not a Cisco-documented workaround. Apply the fixed release when it ships.
Why does a Brotli bug affect products that do not use Node.js?
The flaw sits in the Google Brotli C decoder. Cisco notes this decoder is often bundled with or linked to other software. Any product that includes it may be affected.
What does a CVSS score of 7.4 mean here?
It falls in the High range. The vector shows the attack works over the network and needs no privileges or user interaction. High attack complexity keeps the score below the Critical range.
How do I know when Cisco adds my product to the advisory?
Cisco says it will update the advisory as new information becomes available. Check the advisory page and its version history. Products not listed are considered not affected by Cisco's review.
