Cisco’s updated Node.js advisory lists License (Smart Software Manager) On-Prem among products affected by four high-severity flaws. It names fixed release 10-202610 for that licensing system, while Secure Workload and several other affected products still have release numbers pending. Cisco is investigating Catalyst SD-WAN Manager, Identity Services Engine, IOS variants and Secure Firewall software. Record deployed platforms and installed releases while Cisco assesses their exposure.
The underlying bugs involve the Node.js Brotli decoder, DNS resolution and TLS certificate checks. The Node.js October 21 security release names fixed builds 22.23.4, 24.22.1 and 26.12.1 for supported release lines. Those are Node.js versions; owners of Cisco products need the matching Cisco product release. Cisco updated its interim advisory on October 29.
Four flaws, different failure modes
In CVE-2026-111497, an invalid block switch in a malformed Brotli stream causes the streaming decoder to keep adding bytes to an eight-byte internal buffer rather than reject the stream. An application that decompresses attacker-supplied Brotli data with node:zlib can suffer memory corruption, a crash, memory disclosure or potentially code execution. The Brotli CVE record identifies affected Google Brotli library branches: 1.0.3 up to but excluding 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. Node.js ships a bundled decoder, making its security releases the relevant Node.js fix. Patch independently deployed Brotli libraries according to their own versions, and choose the Cisco product upgrade by its Cisco bug and fixed-release entry. Check that bug for platform-specific exposure before assigning the decoder risk to a particular service.
CVE-2026-105482 concerns dns.resolve*() and dns.reverse(). A hostname containing an embedded NUL reaches c-ares as a C string and is silently truncated. Software that approves a full hostname before resolving it can therefore use records for a shorter, different hostname. This affects Node.js 22.x, 24.x and 26.x before their respective fixed builds. The Node.js project describes this as an incomplete fix of CVE-2026-48930: that earlier change covered dns.lookup() and the net and tls host options, while the dns.resolve*() family and dns.reverse() still passed NUL-containing names to c-ares. If you also operate a separate Node.js service that validates hostnames before resolving them, identify which DNS API follows the validation step and update the Node.js release line. A hostname allowlist alone cannot protect the call when the resolver looks up a different name.
The other two bugs affect certificate identity checks. With CVE-2026-105483, fullwidth digits in an IPv4 host can cause tls.checkServerIdentity() to compare a certificate’s DNS names against an IP endpoint, bypassing the expected IP-address subject alternative name check. The CVE record limits that issue to Node.js 24.x and 26.x. With CVE-2026-106069, a leading-zero IPv4 spelling can be read as octal by WHATWG URL normalization and as decimal by a platform resolver such as macOS’s; the certificate can then be checked against a different address from the one reached. This issue also affects Node.js 22.x. The fullwidth-digit flaw is a regression after the fix for CVE-2026-48618. The leading-zero flaw depends on resolver behavior: the Node.js project cites macOS as a platform that can read the octet as decimal while WHATWG URL normalization reads it as octal. For services that accept hostnames or IP literals as connection targets, trace where the value enters the TLS client and whether the application accepts these noncanonical spellings. Apply the fixed Node.js build for its release line, then check that the application uses the intended destination and certificate identity.
Cisco’s product-status split
Cisco’s affected-products-with-software-fixes table lists Smart PHY, Secure Workload, License On-Prem, Secure Endpoint - Private Cloud Appliance, Intersight Virtual Appliance, AI Canvas, Webex Connect, Intersight and CLI Analyzer. Of those entries, the advisory specifies 10-202610 for License On-Prem. It lists a November 2026 release target for Secure Endpoint - Private Cloud Appliance and Intersight Virtual Appliance, and March 2027 for Smart PHY, with release numbers still to be determined. Product-specific Cisco bug IDs in the table include CSCwx49003 for License On-Prem, CSCwx48980 for Secure Endpoint - Private Cloud Appliance and CSCwx49006 for Smart PHY. The affected table also separates cloud-hosted AI Canvas, Webex Connect and Intersight from software an organization installs itself. For self-managed License On-Prem, collect the installed version and plan a maintenance window; for cloud-hosted AI Canvas, Webex Connect and Intersight, track Cisco service updates. Treat a projected month in the Cisco table as a planning marker until the product bug names a release.
Cisco lists Catalyst SD-WAN Manager, ISE, IOS, IOS XE, IOS XR, NX-OS, ASA, FMC and FTD as under investigation. Cisco says products absent from the advisory have been reviewed as unaffected; its explicitly confirmed-unaffected list includes Secure Network Analytics and Nexus Dashboard. Cisco says public proof-of-concept code exists and that PSIRT is aware of no malicious use against Cisco products. The advisory states, “No workarounds available”; product-specific bugs carry subsequent fix information.
Match releases to deployed products
Pull the deployed product and software-release inventory for License On-Prem and the other affected entries, then match each installation against Cisco’s product table and its linked bug. For License On-Prem, schedule the Cisco 10-202610 release through compatibility and maintenance checks, then verify the installed version after the change. Cisco advises confirming sufficient device memory and continued support for the installed hardware and configuration before upgrading. For affected products whose release number is pending, track the corresponding Cisco bug and vendor update; the appliance fix must be a Cisco product release.
Keep the investigation group on a separate watch list. Revisit Cisco’s advisory for the specific platform and installed release as its status changes, and ask Cisco TAC about upgrade eligibility or supported configurations where the product bug leaves the path unclear.