On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception.
Vulnerabilities in node.js Affecting Cisco Products: October 2026
About this summary. This is a short excerpt from the description that Cisco PSIRT published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco%20Security%20Advisory%26vs_cat%3DSecurity%20Intelligence%26vs_type%3DRSS%26vs_p%3DVulnerabilities%20in%20node.js%20Affecting%20Cisco%20Products%3A%20October%202026%26vs_k%3D1
Source attribution: headline and facts are from Cisco PSIRT (sec.cloudapps.cisco.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Multiple Node.js CVEs
CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and…
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
OverviewOn October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js…
Brotli2Shell: Beyond Node(2Shell) and HTTP(2Shell)
CVE-2026-111497 demonstrates how a single memory-corruption bug in a widely reused native decoder can affect applications far beyond the runtime where it was first…
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages…
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their…
AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497
Number: AL26-027 Date: October 28, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently…