Cybersecurity
Node.js and Brotli Security Vulnerabilities Affecting Cisco Products
Cisco PSIRT reported security vulnerabilities in Node.js 22.x, 24.x, and 26.x versions on October 21, 2026. These issues involve Brotli decoding, DNS resolution, and TLS certificate verification, posing risks for remote code execution and traffic interception.
The current bulletin lists four CVE identifiers with a High security impact rating. These include CVE-2026-111497 (out-of-bounds write in Brotli decoding), CVE-2026-105482 (DNS resolution truncation involving embedded NUL characters), CVE-2026-105483 (bypassing TLS name verification using full-width IP addresses), and CVE-2026-106069 (bypassing TLS verification with invalid IP addresses).
On October 30, 2026, research extended coverage to Brotli components outside of Node.js. The Google Brotli C decoding vulnerability (CVE-2026-111497) may affect other software. As Cisco noted, unlisted products are considered not affected by these vulnerabilities. Information is being updated.
This is a translated editorial summary. Refer to the original source for the complete announcement.