What Happened
On October 21, 2026, Node.js announced fixes for the Node.js Brotli vulnerability and several other flaws across its 22.x, 24.x and 26.x release lines. Cisco's advisory covers four High severity issues in the Brotli decoder, DNS resolution and TLS certificate validation, and says the flaws pose risks for remote code execution and traffic interception.
Cisco says it expanded its investigation to cover Brotli outside of Node.js on October 30, 2026. The decoder flaw sits in the Google Brotli C decoder, which Cisco says is often bundled with or linked to other software, so products beyond Node.js may be affected. Cisco says the advisory will be updated as additional information becomes available.
Google Cloud's bulletin GCP-2026-079, published November 5, 2026, says that per VMSA-2026-0008, Broadcom identified an out-of-bounds write remote code execution vulnerability in the SDDC Manager Node.js Brotli decoder. Google Cloud says it impacts only the VMware solution on Google Cloud running VMware Cloud Foundation 9.1.x, and does not impact Google Cloud VMware Engine.
For an MSP, this is an inventory problem before it is anything else. Node.js ends up inside client APIs, internal tools, dashboards and vendor appliances, and a decoder in the request path that can be made to write out of bounds is a foothold risk. No source reports exploitation in the wild, and fixes exist, so the cost here is the hours spent finding every copy, not an incident.
Timeline
- October 21, 2026: Node.js announced the availability of fixes for multiple vulnerabilities across its 22.x, 24.x and 26.x supported release lines, according to Cisco.
- October 30, 2026: Cisco expanded its investigation to cover Brotli outside of Node.js, because the Google Brotli C decoder is often bundled with or linked to other software.
- November 5, 2026: Google Cloud published bulletin GCP-2026-079 on the SDDC Manager Node.js Brotli decoder issue in the VMware solution on Google Cloud.
- November 10, 2026: Cisco published its advisory, Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026.
- November 13, 2026: Advisories were revised. Fortinet's advisory page carries a revision dated 2026-11-13, and Cisco says its advisory will be updated as additional information becomes available.
Who Is Affected
Node.js 22.x, 24.x and 26.x. Fortinet's advisory says CVE-2026-111497, CVE-2026-105482 and CVE-2026-106069 affect all three lines, and CVE-2026-105483 affects 26.x and 24.x.
Anything bundling or linking the Google Brotli C decoder. Cisco says that decoder is often bundled with or linked to other software, so products beyond Node.js may be affected, and its advisory lists affected Cisco products. Cisco says that if a product is not listed in the advisory, its review indicates the product is not affected by this vulnerability.
VMware Cloud Foundation 9.1.x on the VMware solution on Google Cloud. Google Cloud's bulletin says the issue does not impact Google Cloud VMware Engine.
MSPs with any of the above in client environments. Node.js is often installed by a developer, a vendor or a script, which is how it ends up outside the usual patch cycle.
Why the Node.js Brotli Vulnerability Matters to MSPs
Remote code execution means an attacker runs code inside a service your client depends on. A TLS hostname validation bypass means traffic that should be checked is not, which is where interception starts. Neither is cheap to clean up afterwards: you are restoring data, rebuilding confidence and explaining a timeline.
The work now is smaller than that. Find every Node.js copy, note which ones are internet facing, and patch inside the maintenance windows you already run. As a standing practice, that same version discipline is what keeps the next advisory from turning into a fire drill.
Technical Details
Cisco says these vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution and TLS certificate validation, and that they pose risks for remote code execution and traffic interception. Google Cloud's bulletin describes the SDDC Manager issue as an out-of-bounds write remote code execution vulnerability.
Fortinet's advisory also lists medium and low severity issues in the same release lines: CVE-2026-105481, CVE-2026-106072 and CVE-2026-106074 at medium, and CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073 at low.
- CVE-2026-111497: Brotli decoder out-of-bounds write, potential remote code execution. Cisco lists it as High and says the flaw is in the Google Brotli C decoder. Fortinet's advisory gives it a CVSSv3 score of 9.8 and says it affects Node.js 26.x, 24.x and 22.x.
- CVE-2026-105482: DNS resolution truncation involving embedded NUL characters. Cisco lists it as High. Fortinet says it affects Node.js 26.x, 24.x and 22.x.
- CVE-2026-105483: TLS hostname validation bypass using fullwidth IP digits. Cisco lists it as High. Fortinet says it affects Node.js 26.x and 24.x.
- CVE-2026-106069: TLS hostname validation bypass with noncanonical IP addresses. Cisco lists it as High. Fortinet says it affects Node.js 26.x, 24.x and 22.x.
What MSPs Should Do
This is a patching job with a discovery job underneath it. No source reports exploitation in the wild, and fixes exist, so the order below starts with finding the software.
- Inventory Node.js across every client environment. Include APIs, internal tools, dashboards, build pipelines and anything a vendor installed that bundles or links the Google Brotli C decoder.
- Update Node.js to a fixed release in the 22.x, 24.x or 26.x line.
- For the VMware solution on Google Cloud running VMware Cloud Foundation 9.1.x, apply the Broadcom-recommended workarounds in VMSA-2026-0008.
- For Cisco products, check the advisory's product list. Cisco says a product that is not listed is not affected by this vulnerability, so do not spend the window chasing gear the advisory clears.
- Prioritize internet-facing and client-facing Node services. Remote code execution and traffic interception are the two risks Cisco names, and both are worse at the edge of the network.
- Recheck the advisory before you close the ticket. Cisco says it will be updated as additional information becomes available, and the Brotli investigation already expanded once, on October 30, 2026.
- As a standing practice, confirm your backup and recovery position for anything you change. If a service is compromised before you patch it, the difference is whether you can bring it back clean.
How EnterProtect Helps
Patching is the fix, and nothing here replaces it. EnterProtect covers the parts around patching that MSPs carry.
EnterProtect backup keeps clean, restorable copies of client data and systems, so a failed update or a compromise inside the patch window has a way back. EnterProtect recovery gets a client running again from those copies, which is the outcome that matters when a service is down and the phone is ringing.
EnterProtect vulnerability scanning helps you keep track of exposed versions across client environments as a standing practice, so version drift surfaces before it becomes a scramble.
EnterProtect does not detect, block or prevent this attack. It is the layer that decides how bad a bad day gets.
Frequently Asked Questions
What Is CVE-2026-111497?
It is a Brotli decoder out-of-bounds write that Cisco describes as a potential remote code execution issue. Cisco rates it High, and Fortinet's advisory gives it a CVSSv3 score of 9.8. Cisco says the flaw is in the Google Brotli C decoder, and Fortinet says it affects Node.js 26.x, 24.x and 22.x.
Which Node.js Versions Need Updating?
Node.js announced fixes across the 22.x, 24.x and 26.x release lines on October 21, 2026, and Cisco's advisory covers those same lines. The fix is a version update, not a configuration change. Update to a fixed release in whichever line you run.
Is the Brotli Flaw Limited to Node.js?
No. Cisco says it expanded its investigation on October 30, 2026 to cover Brotli outside of Node.js, because the Google Brotli C decoder is often bundled with or linked to other software. That means products beyond Node.js may be affected, including Cisco products listed in the advisory.
Are These Flaws Being Exploited Right Now?
No source reports exploitation in the wild. Fixes are available, which is why the practical work is inventory and patching rather than incident response. Cisco says its advisory will be updated as additional information becomes available, so check it again before you close the job.
What Do the TLS Flaws Actually Do?
CVE-2026-105483 is a TLS hostname validation bypass using fullwidth IP digits, and CVE-2026-106069 is a TLS hostname validation bypass with noncanonical IP addresses. Cisco rates both High and says the flaws pose risks including traffic interception. Fortinet says CVE-2026-105483 affects Node.js 26.x and 24.x.
We Run VMware Cloud Foundation on Google Cloud. What Applies to Us?
Google Cloud's bulletin GCP-2026-079 says the SDDC Manager Node.js Brotli decoder issue impacts only the VMware solution on Google Cloud running VMware Cloud Foundation 9.1.x, and does not impact Google Cloud VMware Engine. The step the bulletin gives is to apply the Broadcom-recommended workarounds in VMSA-2026-0008.
Sources
- Node2Shell CVEs (Fortinet Psirt)
- Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026 (Cisco Psirt)
- GCP-2026-079 (Google Cloud Security Corrected)