What Happened
A high-severity Node.js vulnerability is on Cisco's advisory list, and for MSPs the cost shows up as a late-night call from a client. Patch Node.js supported release lines 22.x, 24.x, and 26.x first, then check the Cisco advisory for affected products.
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across those supported release lines. Cisco published an advisory covering four CVEs that affect critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. Cisco gives the vulnerabilities a Security Impact Rating of High and says they pose risks for remote code execution and traffic interception.
This is not a single bug. It is four distinct flaws. One of them, the Brotli decoder issue, may reach beyond Node.js because the vulnerable code is often bundled with other software.
Timeline
- October 21, 2026: Node.js announced fixes for multiple vulnerabilities across supported release lines 22.x, 24.x, and 26.x.
- October 30, 2026: Cisco expanded its investigation to cover Brotli outside of Node.js.
- November 2, 2026: Cisco published its advisory on vulnerabilities in Node.js affecting Cisco products.
- November 4, 2026: Cisco updated the advisory to reflect the expanded Brotli investigation.
- November 5, 2026: Cisco updated the advisory again.
Who Is Affected
Any Node.js deployment running a supported release line 22.x, 24.x, or 26.x that has not applied the October 21 fixes is affected. That includes application servers, build tooling, and other runtimes you manage for clients.
Cisco products are in scope for this advisory. Cisco says that if a product is not listed within the advisory, its review indicates the product is not affected. Check the advisory's product list before assuming a Cisco device is safe.
The affected surface widened on October 30, 2026. The Brotli decoder flaw, CVE-2026-111497, is in the Google Brotli C decoder, which is often bundled with or linked to other software. Cisco says products beyond Node.js may be affected, so a third-party application could carry the same vulnerable decoder even if it does not use Node.js.
In short, the affected population is unpatched Node.js runtimes, affected Cisco products, and any software that bundles the vulnerable Brotli decoder.
Why This Node.js Vulnerability Matters
Remote code execution is the outcome that keeps MSPs up at night. An out-of-bounds write in the Brotli decoder can lead to code execution, which means an attacker could run commands on the affected system. The two TLS hostname validation bypasses and the DNS resolution issue can let an attacker intercept traffic that should be encrypted.
For an MSP, the business impact is downtime, data exposure, and a client who wants to know why nobody caught it. Patch management is the first line of defense, but you also need visibility into what is running and a way to restore a system that goes bad.
High-severity flaws in widely used runtimes get reverse engineered quickly. Clients will expect you to have already acted, and the fix from Node.js has been available since October 21, 2026.
Technical Details
The following CVEs are addressed in Cisco's advisory. Cisco gives all four a Security Impact Rating of High.
The affected product is Node.js, with fixes announced on October 21, 2026, across supported release lines 22.x, 24.x, and 26.x. The Brotli decoder flaw, CVE-2026-111497, is in the Google Brotli C decoder and is often bundled with or linked to other software, so products beyond Node.js may be affected. Cisco says the vulnerabilities pose risks for remote code execution and traffic interception.
- CVE-2026-111497: Brotli decoder out-of-bounds write; potential remote code execution.
- CVE-2026-105482: DNS resolution truncation involving embedded NUL characters.
- CVE-2026-105483: TLS hostname validation bypass using fullwidth IP digits.
- CVE-2026-106069: TLS hostname validation bypass with noncanonical IP addresses.
What MSPs Should Do
Patch first, then verify. Work through these steps now.
- Inventory every Node.js runtime in your own stack and across your clients. Flag any system running a supported release line 22.x, 24.x, or 26.x that has not applied the fixes announced on October 21, 2026.
- Apply the Node.js fixes to all affected runtimes. If a system cannot be patched immediately, isolate it from untrusted network traffic until the patch is in place.
- Check the Cisco advisory for affected Cisco products. If a product is listed, apply Cisco's remediation or mitigations. If it is not listed, Cisco's review indicates it is not affected.
- Identify software that bundles or links the Google Brotli C decoder. Because the decoder is often bundled with other software, check vendor advisories and apply updates when they become available.
- Review TLS certificate validation and DNS resolution behavior on systems running Node.js after patching. The TLS and DNS flaws can allow traffic interception, so verify that validation is working as expected.
- Confirm your backups are current and test a restore before you patch. If a patch causes issues, a clean, restorable copy gets the client running again without a long rebuild.
How EnterProtect Helps
EnterProtect does not claim to block or prevent this threat. Its role is to give you the operational base you need before and after an incident.
EnterProtect vulnerability scanning finds exposed versions across your estate, so you can see which systems need attention and prioritize patching. EnterProtect backup keeps clean restorable copies of client systems and data. If a client is hit and a system goes down, recovery gets that client running again from a known-good point.
For an MSP, the worst case is a client who cannot get back to work. EnterProtect backup and recovery are built around that scenario.
Frequently Asked Questions
What Is the Node.js Vulnerability Cisco Is Warning About?
Cisco published an advisory covering four high-severity CVEs in Node.js: a Brotli decoder out-of-bounds write, a DNS resolution truncation issue, and two TLS hostname validation bypasses. The flaws affect supported release lines 22.x, 24.x, and 26.x and can lead to remote code execution or traffic interception.
Which Node.js Versions Are Affected?
Node.js announced fixes on October 21, 2026, for supported release lines 22.x, 24.x, and 26.x. Any deployment on one of those lines that has not applied the fixes is affected.
Does This Affect Cisco Products Only?
No. Cisco products that embed Node.js are affected, but the Brotli decoder flaw is in the Google Brotli C decoder, which is often bundled with other software. Cisco expanded its investigation on October 30, 2026, to cover Brotli outside Node.js, so products beyond Node.js may be affected.
What Should an MSP Do First?
Patch Node.js runtimes on the affected release lines first, then check the Cisco advisory for affected products. Inventory any software that bundles the Google Brotli C decoder, review TLS and DNS settings after patching, and confirm backups are current.
Can an Attacker Exploit These Flaws Remotely?
Cisco says the vulnerabilities pose risks for remote code execution and traffic interception. The Brotli decoder out-of-bounds write is the code execution risk, while the DNS and TLS flaws can let an attacker interfere with or intercept traffic.
Is There a Patch Available?
Yes. Node.js announced fixes on October 21, 2026, across supported release lines 22.x, 24.x, and 26.x. Apply those fixes and follow the Cisco advisory for affected Cisco products.
Sources
- Vulnerabilities in Node.js Affecting Cisco Products: October 2026 (Cisco Psirt)
- Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026 (Cisco Psirt)