What Happened
On October 21, 2026, Node.js announced fixes for multiple vulnerabilities in its supported release lines 22.x, 24.x, and 26.x. On October 30, 2026, Cisco published an advisory about the Node.js vulnerability affecting some of its products. Cisco rates four of the vulnerabilities High under its Security Impact Rating.
Cisco says the issues affect the Brotli decoder, DNS resolution, and TLS certificate validation. The advisory says the vulnerabilities pose risks for remote code execution and traffic interception. Cisco also says the advisory will be updated as additional information becomes available.
Timeline
Here are the dates from the advisory:
- October 21, 2026Node.js announced the availability of fixes for multiple vulnerabilities across supported release lines 22.x, 24.x, and 26.x.
- October 30, 2026Cisco published its advisory, Vulnerabilities in Node.js Affecting Cisco Products: October 2026, and rated four of the issues High.
Who Is Affected
The affected software is Node.js supported release lines 22.x, 24.x, and 26.x. For Cisco, the affected products are the ones listed in the advisory. Cisco says its review indicates that a product not listed in the advisory is not affected.
For an MSP, this matters in two places. You may run Node.js in your own tooling or in client applications. You may also manage Cisco products that include Node.js. The advisory's product list is the source of truth for Cisco hardware and software.
Technical Details: The Node.js Vulnerability
Cisco's advisory lists these four High-severity vulnerabilities:
- CVE-2026-111497: Brotli decoder out-of-bounds write with potential remote code execution.
- CVE-2026-105482: DNS resolution truncation involving embedded NUL characters.
- CVE-2026-105483: TLS hostname validation bypass using fullwidth IP digits.
- CVE-2026-106069: TLS hostname validation bypass with noncanonical IP addresses.
What This Means for MSPs
The hard part of this advisory is not applying a patch. It is knowing where Node.js runs. Node.js shows up in developer workstations, build servers, server-side applications, and network appliances. As a standing practice, your inventory should include third-party software that embeds a runtime, not just the applications you wrote.
The TLS hostname validation bypasses deserve attention even without a known attack. If a client cannot be sure it is talking to the right server, encryption does less work. Reviewing certificate validation paths is a normal part of maintaining any stack that makes outbound TLS connections.
What to Do This Week
Work through these steps in order:
- Inventory Node.js. Find every release line in use across your clients, including appliances and tools that embed Node.js. Pay attention to 22.x, 24.x, and 26.x.
- Apply the fixes Node.js announced on October 21, 2026, to the supported release lines you run. If you run an older release line, plan an upgrade because there may be no fix for it.
- Compare the Cisco advisory product list against your installed Cisco products. If a product is listed, follow Cisco's remediation guidance. If it is not listed, Cisco says it is not affected.
- Review TLS hostname validation in your own applications. As a standing practice, confirm certificate checks are enforced in both test and production paths.
- Stage and test patches before rollout. Node.js is often embedded in a larger stack, and a fast patch can break a working application.
What to Tell Clients
Node.js released fixes for several high-severity vulnerabilities on October 21, 2026. Cisco published an advisory covering some of its products, so we are reviewing anything in your environment that runs Node.js or a Cisco product listed in the advisory.
Four of the issues are rated High. One is a Brotli decoder problem that could allow remote code execution. Two are TLS hostname validation bypasses, and one affects DNS resolution with embedded NUL characters.
We are applying the available Node.js fixes and checking the Cisco product list as part of normal patch management. We will test before rollout and tell you if any of your systems need an immediate maintenance window.
No action is needed from you right now. If you run Node.js applications outside our management, send us the version numbers so we can include them in the review.
Frequently Asked Questions
Which Node.js Release Lines Are Affected by These Vulnerabilities?
The affected release lines are Node.js 22.x, 24.x, and 26.x, according to Cisco's advisory. Node.js announced fixes for these release lines on October 21, 2026. Check the version on any server, appliance, or tool that runs Node.js.
What Are the CVEs in the Cisco Node.js Advisory?
The four High-severity CVEs are CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069. They cover a Brotli decoder out-of-bounds write, a DNS resolution truncation issue, and two TLS hostname validation bypasses.
Can These Node.js Vulnerabilities Lead to Remote Code Execution?
CVE-2026-111497 is a Brotli decoder out-of-bounds write with potential remote code execution, according to Cisco. The other three High-severity issues are DNS resolution truncation and TLS hostname validation bypasses. Cisco says the overall risks are remote code execution and traffic interception.
Are All Cisco Products Affected by the Node.js Vulnerabilities?
No. Cisco says products not listed in its advisory are not affected. You need to compare the product list in the advisory against the Cisco devices, appliances, and software you manage.
What Should an MSP Do First About This Advisory?
Start with an inventory of Node.js installations and a check of the Cisco advisory product list. Apply the fixes announced on October 21, 2026, and follow Cisco's remediation guidance for any listed products. Test patches before rollout.
Why Do TLS Hostname Validation Bypasses Matter?
Hostname validation is how a client confirms a certificate belongs to the server it is connecting to. A bypass can allow traffic to be redirected or intercepted. The general fix is to patch Node.js and review certificate validation logic in your own applications.
Sources
- Vulnerabilities in Node.js Affecting Cisco Products: October 2026Cisco Psirt · Official
- AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497Canada Alerts · Official