At a glance
- Cisco warns of four Node.js and Brotli vulnerabilities affecting some products.
- CVE-2026-111497 could allow remote code execution; the other flaws involve DNS and TLS hostname verification.
- The stated Nexus 3000/9000 scope is standalone NX-OS with Guest Shell.
- Check versions and upgrade to the corresponding fixed release; no workaround is currently available.
Cisco: Four Node.js and Brotli Vulnerabilities Affect Some Products; Check Fixed Releases
Cisco warns that four Node.js and Brotli vulnerabilities affect some products, including a Brotli flaw that could allow remote code execution. Identify affected products, compare their release branches with Cisco’s fixes, and upgrade accordingly; no workaround is currently available.
In this article
Cisco PSIRT published an advisory about four Node.js and Brotli vulnerabilities affecting some Cisco products. Administrators should match each product and release branch against the fixes listed in the Cisco advisory.
Overview and technical details
Node.js is a JavaScript runtime; Brotli is a data-compression library whose decoder is integrated into or linked with many software products. Cisco lists four vulnerabilities: an out-of-bounds write in the Brotli decoder that could allow remote code execution, a DNS resolution truncation issue involving an embedded NUL character, and two TLS hostname verification bypasses.
| Field | Details |
|---|---|
| Product/component | Node.js and Brotli; the Brotli flaw is in the Google Brotli C decoder. |
| CVE | CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069 |
| CVSS | CVSS 3.0: 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:X/RL:X/RC:X); SIR: High |
| CWE | CWE-252, CWE-284, CWE-295 |
The flaws affect the Brotli decoder, DNS resolution, and TLS certificate verification; stated impacts include remote code execution or traffic interception. The Brotli flaw may also affect software outside Node.js when the library is packaged or linked. Specific deployment conditions depend on each Cisco product.
Affected systems
Cisco lists the following products and corresponding fixes. Entries marked “Release no. TBD” do not yet have a fixed release number in the supplied information; dates in parentheses are retained as listed in the source.
| Product | Fix/version details |
|---|---|
| AI PODs for Collaboration | 1.0.2 (Nov 2026) |
| Smart PHY | CSCwx49006; Release no. TBD (Mar 2027) |
| Packet Tracer | 9.2.0 (Dec 2026) |
| Duo Network Gateway | 3.4.2 |
| Duo Authentication Proxy Local Manager for Windows | 6.8.1 (Nov 2026) |
| Hypershield | Release no. TBD |
| Secure Workload | Release no. TBD (Feb 2027) |
| Business Process Automation (BPA) | CSCwx48997; 5.0 (Nov 2026), 5.1 (Nov 2026) |
| Common Services Platform Collector | 2.11.0.9 (Nov 2026) |
| Elastic Services Controller (ESC) | 6.0.0.68 (Dec 2026) |
| Optical Network Controller | Release no. TBD |
| Provider Connectivity Assurance | Release no. TBD |
| Secure Endpoint - Private Cloud Appliance | CSCwx48980; Release no. TBD (Nov 2026) |
| Virtualized Infrastructure Manager | CSCwx48998; Release no. TBD |
| Nexus 3000 Series Switches, standalone NX-OS (Guest Shell) | CSCwx56979; Guestshell 4.9 or NX-OS 9.3.19 (Jan 2027), 10.3.11 (Dec 2026), 10.4.9 (Feb 2027), 10.5.7 (Jan 2027), 10.6.5 (Feb 2027), 10.7.1 (Jan 2027) |
| Nexus 9000 Series Switches, standalone NX-OS (Guest Shell) | CSCwx56979; Guestshell 4.9 or NX-OS 9.3.19 (Jan 2027), 10.3.11 (Dec 2026), 10.4.9 (Feb 2027), 10.5.7 (Jan 2027), 10.6.5 (Feb 2027), 10.7.1 (Jan 2027) |
| Private 5G | CSCwx48976; 22.23.4 (TBD) |
| Ultra Cloud Core - Redundancy Configuration Manager | Release no. TBD |
| Intersight Virtual Appliance | 1.1.8-2 (Nov 2026) |
| AI Canvas | 26.10.4 |
| AppDynamics SaaS | Release no. TBD |
| Cloudlock | Release no. TBD (Nov 2026) |
| Intersight | Release no. TBD (Nov 2026) |
| Security Cloud Control | 20261030-b3cffcb (Nov 2026) |
| Spaces | 24.22.1 |
| ThousandEyes BrowserBot | Cloud remediated; no customer action required |
| Webex Connect | 6.22.2 (Nov 2026) |
| Webex Contact Center | 22.23.4/24.22.1 (Nov 2026) |
| CLI Analyzer | Release no. TBD |
| IQ Link | 1.3.1 (TBD) |
| IQ Virtual Appliance | 1.3.1 (TBD) |
| Collaboration Endpoints running RoomOS (Board, Desk, and Room Series) | CSCwx44334; RoomOS On-premises 11.41.2.3 and 26.7.4.3; RoomOS Cloud September 2026 / 26.9.1 or later for the current generation, 11.41.1 or later for the previous generation |
| Cloud Connect | 15.0.SU3 - ES 202701 |
| Connected Mobile Experiences (CMX) | 11.2 (TBD) |
For Nexus 3000 and Nexus 9000, the advisory specifies standalone NX-OS systems with Guest Shell. Cisco confirms that products not listed in the advisory are not affected. Cisco priority products confirmed not affected are Catalyst SD-WAN Software, Identity Services Engine (ISE), IOS XE Software, IOS XR Software, Secure Firewall ASA Software, Secure Firewall Management Center (FMC) Software, and Secure Firewall Threat Defense (FTD).
Cisco also confirms the following products are not vulnerable: Intelligent Node Manager; Secure Client; Cloud-Delivered Firewall Management Center (cdFMC); ISE Passive Identity Connector (ISE-PIC); Secure Firewall ASAv; Secure IPS; Secure Email Gateway; Secure Malware Analytics - Private Cloud (Appliance); Secure Network Analytics; Telemetry Broker; Business Dashboard; Catalyst SD-WAN Analytics, Controller, Portal, Manager, and Validator; Crosswork Workflow Manager; Data Center Network Manager; License (Smart Software Manager) On-Prem; Mesh Policy Engine; Optical Network Planner; Nexus Dashboard; SAN Insights D.
System checks
On a Nexus 3000 or Nexus 9000 running standalone NX-OS, check the software version:
show versionCheck whether Guest Shell is in use:
show guestshell
If the device is a Nexus 3000 or 9000 running standalone NX-OS with Guest Shell, compare the NX-OS version with the fixed releases listed above; Guest Shell requires version 4.9 or one of the stated NX-OS releases.
Remediation and mitigation
Upgrade each affected product to its corresponding fixed release in Cisco’s list. For Nexus 3000/9000 running standalone NX-OS with Guest Shell, update Guest Shell to 4.9 or NX-OS to one of the listed fixed releases.
Search Cisco Bug Search Tool by Cisco Bug ID for platform-specific information.
For products without a fixed release number, monitor the advisory and Cisco Bug Search Tool for updates. Cisco confirms that no temporary workaround is currently available.
References
Related articles
Cisco calls for eMudhra CA distrust after intermediate certificate keys found weak
Cisco says a 2025 key-generation flaw left private keys for eight eMudhra intermediate CA certificates weak enough to brute-force in seconds. Review affected Cisco products and apply the corresponding distrust guidance or update.