Four issues received a High Security Impact Rating after Node.js announced fixes across its supported release lines on October 21, 2026. The flaws involved Brotli decoding, DNS resolution, and TLS certificate validation, giving security teams several areas to check at once.
Cisco published its advisory on October 27, then updated it through October 30 as its review continued. The notice showed that status could vary by product: some were still under review, while others had fixes available. That makes the advisory’s timeline important when you assess your own systems.
This guide explains how to use the October notice to review exposure, find product-specific guidance, and plan software upgrades. You’ll also see what to check when a Cisco security vulnerability advisory changes over time. A careful review can help you choose the right next step.
Key Takeaways
- Node.js announced fixes across supported release lines on October 21, 2026.
- Cisco’s advisory first appeared on October 27 and received updates through October 30.
- Four issues carried a High Security Impact Rating.
- The reported issues involved Brotli decoding, DNS resolution, and TLS certificate validation.
- Product status varied as Cisco continued its review; check the advisory for current guidance.
- Use the notice to assess exposure and plan any needed software upgrades.
October 2026 Cisco Node.js Advisory at a Glance
The advisory’s revision trail shows how guidance shifted over four days. Its October 30, 2026, version 1.3 update revised affected-product details and kept the notice marked interim. The review had not closed, so product status could still change.
What the October 30 update says
Version 1.3 gave readers a newer view of affected offerings and those confirmed as not affected. It continued the review rather than serving as a final notice. Check the latest version before acting on an earlier status.
How the advisory changed through the month
The public timeline began with version 1.0 on October 27. Cisco posted version 1.1 on October 28, version 1.2 on October 29, then version 1.3 on October 30.
Use this history to see when status details changed and whether your assessment needs an update. The separate security vulnerability policy explains how Cisco publishes security guidance; the advisory history tracks changes to this notice.
vulnerabilities in node.js affecting cisco products: Current Status
On October 30, 2026, Cisco’s interim notice listed four issues with a High Security Impact Rating. The vulnerabilities described in the advisory involved separate parts of the runtime, so each called for a distinct technical review.
- CVE-2026-111497: A Brotli decoder out-of-bounds write could allow remote code execution.
- CVE-2026-105482: DNS resolution could truncate data when it encountered embedded NUL characters.
- CVE-2026-105483 and CVE-2026-106069: Both issues involved TLS hostname validation bypasses.
These findings did not mean every Cisco product was exposed. The company was investigating its product line, and its assessment depended on the software used by each offering. Cisco said it would update the notice as more product details became available.
Use the October 30 notice as a dated status snapshot, not a final statement about current exposure. For a Cisco security vulnerability review, check the advisory for the specific product and software version you use.
Node.js Fixes Across Supported Release Lines
Upstream release notes gave security teams a clear starting point for the October review. On October 21, 2026, Node.js announced security fixes for supported 22.x, 24.x, and 26.x release lines.
That announcement established the fix context for Cisco’s review of offerings that used the affected runtime. But it did not confirm which systems needed action. Your exposure depended on the specific offering and software configuration you ran.
Updates for 22.x, 24.x, and 26.x
The three release lines gave users a clear view of where upstream fixes were available. They did not serve as a Cisco upgrade guide. The advisory tracked affected offerings and fixed software separately, so you still needed guidance for your exact model and software train.
Why the date mattered to your review
Treat the release details as context, not proof of exposure. Compare your setup with the advisory, then review the defects behind the fixes: Brotli decoding, DNS handling, and TLS hostname checks. Those details help you focus the next stage of your assessment.
| Review detail | What it showed | What you should check |
|---|---|---|
| Announcement date | October 21, 2026 | Upstream fix timing |
| Supported lines | 22.x, 24.x, and 26.x | Your offering’s software version |
| Advisory status | Product-specific review and fixes | Current guidance for your configuration |
High-Impact CVEs Listed in Cisco’s Advisory
The notice assigned all four CVEs a High Security Impact Rating, though each had a distinct cause. Here, the phrase “vulnerabilities described advisory” refers to these findings; it does not mean every Cisco system faced exposure. A cisco security vulnerability notice still needs review against the exact offering and software version.
Brotli Decoder Out-of-Bounds Write: CVE-2026-111497
This flaw involved a Brotli decoder writing beyond its intended memory area. Cisco’s advisory described potential remote code execution, which could let an attacker run code on an affected system.
DNS Truncation and TLS Hostname Validation Flaws
- CVE-2026-105482: DNS resolution could truncate data when embedded NUL characters appeared in input.
- CVE-2026-105483: TLS hostname checks could be bypassed with fullwidth IP digits.
- CVE-2026-106069: A separate TLS flaw involved noncanonical IP addresses.
These CVEs had different technical causes. Use the advisory’s product-specific status to assess exposure; a CVE listing alone does not confirm that your system was affected.
Potential Security Consequences for Your Systems
The October advisory linked the reported flaws to possible remote code execution and traffic interception. These outcomes could put system integrity and private data at risk, so a focused review mattered. They were potential consequences, not proof of exposure.
The risks matched specific operations: Brotli decoding, DNS resolution, and TLS certificate validation. A weakness across one area could create a different path to harm. For example, a decoder flaw may threaten code execution, while a TLS validation flaw may let an attacker intercept traffic.
Do not assume every Cisco product or deployment faced the same risk. Cisco’s advisory listed product-specific status, and that status could vary by software release. Check each system’s name, model, configuration, and installed version before choosing an upgrade or other response.
| Operation | Potential concern | Review step |
|---|---|---|
| Brotli decoding | Possible remote code execution | Match the system’s software to Cisco’s status details |
| DNS resolution | Data may be truncated | Check the relevant software version |
| TLS certificate validation | Possible traffic interception | Confirm status for each system |
Cisco Priority Products Still Under Investigation
Cisco’s priority list covered nine offerings that still needed review. That status helped you spot areas to monitor, but it did not confirm exposure. “Under investigation” also did not provide a fixed-release date.
Identity, operating system, and firewall product lines
The list included Catalyst SD-WAN Manager and Identity Services Engine (ISE). It also named four operating system lines: IOS Software, IOS XE Software, IOS XR Software, and NX-OS Software.
Three firewall offerings rounded out the priority list: Secure Firewall Adaptive Security Appliance (ASA) Software, Secure Firewall Management Center (FMC) Software, and Secure Firewall Threat Defense (FTD). Each status remained subject to review.
These entries showed where Cisco focused its assessment; they did not prove that a flaw affected each offering. Nor did the listing promise when a software fix would arrive. Check later advisory updates for changes to status or release guidance. Your review should match the exact offering and software version you use, rather than rely on the priority list alone.
Additional Cisco Products Under Active Review
Cisco’s October 30 advisory also listed a broad range of services and systems for active investigation. That status did not confirm final impact; check the updated notice against your own setup.
Services, cloud-hosted offerings, and infrastructure
- Application Observability: AppDynamics, AppDynamics Enterprise Console, AppDynamics Virtual Appliance. Cable Devices: Intelligent Node Manager. Collaboration and Social Media: AI PODs for Collaboration.
- Network and Content Security: Cryptographic Services PureCA (Private PKI CA), Hypershield, ISE Passive Identity Connector (ISE-PIC), Secure Firewall Adaptive Security Virtual Appliance (ASAv), Secure IPS (formerly Cisco Next-Generation Intrusion Prevention System (NGIPS)), Telemetry Broker.
- Management and Routing: BGP Traffic Engineering Controller, Business Process Automation (BPA), Crosswork Hierarchical Controller, Crosswork Workflow Manager, Elastic Services Controller (ESC), Optical Network Controller, Optical Network Planner, Provider Connectivity Assurance, ThousandEyes Enterprise Agent, Virtualized Infrastructure Manager; ASR 5000 Series Software (StarOS), Cloud Native Deployment Platform (CNDP), Enterprise NFV Infrastructure Software (NFVIS), NextFusion Platform, Policy Suite (CPS), Private 5G, Ultra Packet Core—Redundancy Configuration Manager (RCM), Ultra Packet Core—Subscriber Microservices Infrastructure.
- Other systems: HyperFlex HX Data Platform, UCS Software, Webex Desk Camera, Cloud Connect, Connected Mobile Experiences (CMX), Industrial Wireless Monitor.
- Cloud-hosted services: AppDynamics SaaS, Cloud Native Application Observability, Cloudlock, IoT Operations Dashboard, LMA, Robust Intelligence RIME, Secure Email Threat Defense, Secure Workload SaaS, Security Cloud Sign On, Smartlook, Spaces, ThousandEyes, Umbrella, Vidcast, Vulnerability Management (formerly Kenna.VM), Webex AI Agent, Webex Assistant for Meetings, Webex Collaboration Control Hub, Webex Contact Center, Webex Integrations and Bots, Webex Interact, WG2.
- Cisco Services: Business Critical Insights, CDT, CX Cloud, IQ, Managed Services Platform, Readiness Assessment Tool for Cloud, SD-WAN Cloud OnRamp, Secure Transfer Service.
Compare each name and version with the advisory before deciding on next steps.
Cisco Products Listed With Software Fixes
The advisory separated offerings with a named fixed release from entries whose release details remained incomplete. Treat estimated dates as planning guidance, not confirmed delivery dates. Check the latest status before you schedule an upgrade.
Products with fixed releases or fixes already deployed
- Duo Access Gateway: Fixed release 3.4.2.
- Webex Connect: Fixed release 6.22.2, estimated for November 2026.
- Duo Authentication Proxy Local Manager for Windows: Version 3.8.1, estimated for November 2026.
Entries with release dates still to be confirmed
- Smart PHY: Bug CSCwx49006; release number not set, with delivery estimated for March 2027. Catalyst Center (formerly DNA Center) has bug CSCwx48988; its release number was not set.
- Secure Endpoint—Private Cloud Appliance (CSCwx48980), Intersight Virtual Appliance, Security Cloud Control, and Intersight had no set release numbers. Each had an estimated November 2026 date.
- Secure Workload, AI Canvas, and CLI Analyzer: Release numbers were not set. Packet Tracer appeared without a fixed-release value.
The notice listed confirmed-vulnerable offerings and offerings with fixes separately from entries with incomplete release details. Use the status for your exact offering when you plan next steps.
Fixed Release Information and Expected Availability
Release details ranged from named software versions to dates that remained estimates. The fixed release information helps you separate confirmed versions from planned delivery windows. A date alone does not prove that a build suits your setup.
Published versions and delivery estimates
Cisco listed Duo Access Gateway 3.4.2 as a fixed release. Webex Connect 6.22.2 also had a November 2026 availability estimate. The notice estimated November 2026 for Duo Authentication Proxy Local Manager for Windows 3.8.1. Smart PHY, linked to bug CSCwx49006, had no release number and carried a March 2027 estimate. Check the affected fixed release against your software version.
Why estimates can change
Cisco warned that dates could shift after testing or as teams handled other priority features and fixes. Treat estimates as planning guidance, not firm commitments. Review the associated bug for current details, then confirm the affected fixed release before scheduling maintenance. Check the latest fixed release information before you plan an upgrade.
Use the status for each offering, not just its estimated date.
| Offering | Release detail | Availability |
|---|---|---|
| Duo Access Gateway | Version 3.4.2 listed | Fixed release |
| Webex Connect | Version 6.22.2 listed | November 2026 estimate |
| Smart PHY | Bug CSCwx49006; release number unset | March 2027 estimate |
Products Cisco Has Confirmed Are Not Affected
An unaffected status can narrow your review, but it still depends on the advisory’s scope. Cisco’s October update named several offerings its review found outside the reported issue set.
“considered unaffected based on its review.”
- Endpoint client: Secure Client, formerly AnyConnect Secure Mobility Client.
- Security tools: Secure Malware Analytics—Private Cloud (Appliance) and Secure Network Analytics.
- Network management: Business Dashboard, Data Center Network Manager, License (Smart Software Manager) On-Prem, Mesh Policy Engine, Nexus Dashboard, and SAN Insights Discovery.
- Cloud-hosted services: Duo, IoT Control Center, and Secure Email Cloud Gateway.
- Meraki: Meraki Dashboard, plus MR, MS, and MX Series Devices.
Cisco also stated that offerings absent from the advisory were considered unaffected based on its review at that update. That status reflected the scope and timing of the notice; it was not a promise about later changes.
Match each service or device name to your own inventory. Then check the latest advisory before closing your review, since Cisco may revise its assessment as work continues. A dated status gives you a useful checkpoint, not a reason to skip verification.
Exploit Availability and Cisco’s Incident Response Update
Proof-of-concept code can help researchers test a flaw, but its release does not prove a real attack occurred. That distinction shaped the security incident response update from the incident response team during a product security incident review.
Proof-of-concept code is available
PSIRT knew exploit code was available for the Node.js issues. Node.js disclosed the vulnerabilities described in the advisory, while PSIRT shared its product-impact review. The security incident response update said the incident response team had no awareness of malicious use against any covered offering. That was the team’s status at the time, not a claim about later activity.
For a Cisco security vulnerability assessment, treat code availability as a signal to check your exposure, not proof of compromise. This product security incident update did not establish a successful attack against a specific system. Your security incident response should rely on product-specific status; the incident response team reported only what it knew then. For Cisco product security, read the notice as a dated update. This product security incident report separated public research from confirmed activity.
How to Determine Whether Your Cisco Products Are Exposed
Start your exposure review with an accurate inventory, not a broad CVE list. The advisory tracked offerings individually as its investigation progressed, so exact names and software details matter.
Check names, hardware, and software details
Match each device or service to the name used by Cisco. Record its model, hardware setup, software release, and enabled features. Then compare those details with affected entries and related bug IDs. A similar name alone does not confirm exposure.
Recheck updated advisory details
The vulnerable products section could change as new facts emerged. Cisco said it would update the notice when more information became available. It also said offerings absent from the advisory were considered unaffected based on its review. Treat that as a dated finding, then check again for updates.
Cisco advised customers to consult product advisories regularly to determine exposure and find a complete upgrade solution. Revisit cisco security advisories after new findings appear. This helps you act on current guidance, not an old snapshot.
| Review item | What to record | What to compare |
|---|---|---|
| Device or service | Exact name and model | Affected-advisory entries |
| Software setup | Release and enabled features | Bug details and status |
| Review date | Latest advisory version checked | New status or upgrade guidance |
Find Cisco Bug IDs, Workarounds, and Fixed Software Details
The advisory’s vulnerable products section listed bug IDs for affected offerings. Use the ID that matches your system to find details for its platform and software version. This lookup helps you avoid relying on guidance meant for a different setup.
Look Up the Matching Bug Record
Search the ID with the Cisco Bug Search Tool. Each record may list platform-specific details, available workarounds, and fixed software releases. Cisco said product-specific workaround guidance would appear in the related bug record.
- Confirm the bug ID matches your offering and release.
- Review any workaround before applying it.
- Check the listed fixed release against your software.
Do not assume a workaround or version applies to your setup until you check the relevant record. The vulnerable products section points you to that product-specific guidance.
The security vulnerability policy explains disclosure and ways to get security updates. Its disclosure document also contains instructions for obtaining fixed software and receiving security information. See the security vulnerability policy for current guidance on obtaining fixed software; use it alongside the related bug record.
Plan and Apply Cisco Software Upgrades Safely
Before you schedule maintenance, match Cisco’s fixed-release guidance to your exact product and software setup. A release number alone does not confirm that an upgrade fits your system.
Confirm device memory and hardware support before upgrading
Check that each device has sufficient memory, and confirm current hardware and software configurations remain supported by the new release. Review those details again when considering software upgrades, since they can shape your complete upgrade solution.
Cisco advised customers to regularly consult product advisories to determine exposure and choose a complete upgrade solution. Check the latest notice before obtaining fixed software or setting a maintenance window.
Contact the technical assistance team if release guidance is unclear
If release recommendations do not match your setup, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider. Ask them to clarify supported configurations and the right release for your device. Verify memory, hardware support, and product-specific guidance before deployment.
Security Notifications, Disclosure Policy, and Further Guidance
A steady notification routine helps you keep pace as security guidance changes. Cisco’s Security Vulnerability Policy explains its disclosure policies and publications. The policy also contains instructions for obtaining fixed software and receiving security updates from the company.
Use that resource to learn how to request security information and find guidance for supported releases. Check the policy when you need instructions about fixed software or details about security vulnerability disclosure. It can help you make a sound upgrade choice.
Subscribe to security notifications and review disclosure resources
Cisco’s Transition to a Risk-Based Vulnerability Disclosure Model provides further guidance on vulnerability management, release timing, and software patching strategy. Read it alongside current advisories and matching bug records.
- Subscribe to security notifications to track advisory changes.
- Check product status and related bug records before you act.
- Use disclosure resources and current advisories to guide upgrade decisions.
Keep these resources on your review schedule. They can help you follow new security details and choose a suitable next step as guidance changes.
Conclusion
The October 30, 2026, Cisco advisory was still interim, so older status details were only a snapshot. Node.js had announced fixes for release lines 22.x, 24.x, and 26.x on October 21, while Cisco continued its review by offering and software version.
Four CVEs carried a High Security Impact Rating. They involved Brotli decoding, DNS resolution, and TLS hostname checks, with distinct technical causes. Use the latest advisory to confirm your system’s status. Check whether your offering appears under affected or unaffected entries, then read its linked bug record for release guidance.
Before you upgrade, verify memory needs and support for your hardware and software setup. If the recommended release remains unclear, contact Cisco TAC or your maintenance provider. A current status check helps you make a safer, better-informed choice.
