Cisco Node.js Brotli Vulnerabilities Affected Products Explained: Catalyst Center, Duo and Webex Fixes, and the 10 November Deadline

cisco nodejs brotli vulnerabilities affected products — a Cisco Nexus 9000 switch

A Cisco Nexus 9000 switch — Nexus 9000 switches running standalone NX-OS are among the Cisco products the advisory lists as affected. Image: Wikimedia Commons / Antonio Kless, CC BY-SA 4.0.

TL;DR — Cisco Node.js Brotli vulnerabilities affected products explained in one line: Cisco's updated advisory (version 1.6, 4 November 2026) names the Cisco products hit by the Node.js flaws — including Catalyst Center, Duo Network Gateway and Webex Connect — while clearing IOS XE, ISE and its firewalls, and the CISA patch deadline for the worst flaw is 10 November.

📌 KEY HIGHLIGHTS

The advisory: Cisco PSIRT advisory cisco-sa-oct2026-node-js-Jj3SQ19u, updated to version 1.6 on 4 November 2026, covers four High-rated Node.js vulnerabilities, led by the Brotli decoder flaw CVE-2026-111497.
Confirmed affected: Catalyst Center, Duo Network Gateway, Packet Tracer, Webex Connect, Spaces, Secure Endpoint Private Cloud Appliance, Intersight and Nexus 9000 switches in standalone NX-OS mode, among others — with fix dates ranging from November 2026 to July 2027.
Cleared: IOS XE, Identity Services Engine (ISE), Catalyst SD-WAN, Secure Firewall Management Center and Threat Defense (FTD), Secure Client and the whole Meraki line are confirmed not impacted.
Still being checked: IOS XR and Secure Firewall ASA remain under investigation, along with AppDynamics, Hypershield and dozens of other products.
The deadline: CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October, with a federal remediation deadline of 10 November 2026 — and proof-of-concept exploit code is public.

Cisco Node.js Brotli vulnerabilities affected products: what actually happened

On 21 October 2026, the Node.js project shipped security fixes for its 22.x, 24.x and 26.x release lines — 22.23.4, 24.22.1 and 26.12.1. The headline flaw was CVE-2026-111497, an out-of-bounds write in the bundled Google Brotli decoder that can crash a process, leak memory or allow remote code execution when an application decompresses attacker-controlled data. It was quickly nicknamed Node2Shell, then Broccoli2Shell as the same decoder flaw turned up in Python, .NET, Bun, Envoy and other software. CISA added it to the Known Exploited Vulnerabilities catalog on 27 October, confirming real-world exploitation. The same Brotli flaw also ships in SolarWinds Dameware — see our SolarWinds Dameware CVE-2026-28336 explained post for the fix.

That was the runtime. The harder question — which products actually ship that runtime — has taken vendors weeks to answer. Cisco published its advisory on 27 October and has updated it five times since, most recently to version 1.6 on 4 November. The advisory covers four flaws rated High by Cisco: the Brotli decoder flaw (CVE-2026-111497), a DNS resolution truncation bug involving embedded NUL characters (CVE-2026-105482), and two TLS hostname-validation bypasses using fullwidth IP digits and non-canonical IP addresses (CVE-2026-105483 and CVE-2026-106069). The last two matter because they can let an attacker slip past hostname checks and intercept traffic. Cisco says proof-of-concept exploit code is available, but it is not aware of any malicious use against a Cisco product.

Which Cisco products are affected — and when the fixes land

Cisco product	Status	Fixed release
Catalyst Center (formerly DNA Center)	Affected	3.4.1 — July 2027
Duo Network Gateway	Affected	3.4.2 — available
Duo Authentication Proxy Local Manager (Windows)	Affected	6.8.1 — November 2026
Packet Tracer	Affected	9.2.0 — December 2026
Webex Connect	Affected	6.22.2 — November 2026
Spaces	Affected	24.22.1 — available
Secure Endpoint — Private Cloud Appliance	Affected	Release TBD — November 2026
Intersight / Intersight Virtual Appliance	Affected	Release TBD — November 2026
Smart PHY (cable devices)	Affected	Release TBD — March 2027
Nexus 9000, standalone NX-OS (Guest Shell)	Affected	Release TBD
Business Process Automation	Affected	4.1.2 (TBD) / 5.0 (Nov 2026) / 5.1 (TBD)
IOS XR Software	Under investigation	—
Secure Firewall ASA	Under investigation	—

Read the table plainly: the uncomfortable number is Catalyst Center's fix date — July 2027, eight months away — for the product that manages many enterprise networks. Smart PHY is not much better, with a March 2027 target. Cisco publishes a bug ID for each affected product, and the bug records carry the workarounds where any exist, so Catalyst Center customers should read bug CSCwx48988 rather than waiting for the fix. Also note what the table does not say: a product being listed as affected does not mean all four CVEs hit it — the per-product bug records carry the specifics.

cisco nodejs brotli vulnerabilities affected products — a Cisco Catalyst 6509 switch

A Cisco Catalyst 6509 switch — older Catalyst hardware like this predates the affected software, but it shows the scale of Cisco gear running in enterprise networks. Image: Wikimedia Commons / QuakeCon, CC BY 2.0.

Which Cisco products are NOT affected

The good news is extensive, and it covers the products most network teams would worry about first. Cisco has confirmed that IOS XE, Identity Services Engine, Catalyst SD-WAN Software, Secure Firewall Management Center and Threat Defense are not impacted, along with Secure Client (formerly AnyConnect), Nexus Dashboard, Secure Network Analytics, Umbrella, Duo, Secure Email Cloud Gateway and the entire Meraki line — Dashboard and MR, MS and MX devices. Cisco's rule is explicit: if a product is not listed in the advisory at all, its review found the product not affected. Splunk, which Cisco owns, has its own advisory (SVD-2026-1015, dated 28 October) and still lists Splunk Enterprise, Cloud Platform, Universal Forwarder and SOAR as under investigation.

Why it matters for India readers

Indian enterprises run a lot of this gear. Catalyst Center and ISE sit at the heart of campus and branch networks in banks, IT services firms and government offices, and Cisco's verdicts split exactly along that line: ISE is clear, Catalyst Center is not. The timing also matters. The CISA deadline of 10 November binds only US federal civilian agencies, but it signals how fast attackers are expected to move — the flaw is already in CISA's exploited list, exploit code is public, and a second Node.js security release with further High-rated fixes is already scheduled for 11 November. Indian Node.js developers face the same clock: any app on Node.js 22.x before 22.23.4, 24.x before 24.22.1 or 26.x before 26.12.1 is still exposed, and Node.js 20.x and older lines get no fix at all. This is the same supply-chain pattern as the Siemens advisory we covered on 31 October — one library flaw, dozens of vendors, months of follow-up advisories.

Should you care?

✅ Verdict: yes, if your network or your code touches Cisco or Node.js — but check the list, don't panic. Most of Cisco's flagship network operating systems are cleared, and the affected products are mostly management and collaboration software with fixes already out or due this month. The real risk is the long tail: Catalyst Center's fix is eight months away, and several products have no date at all. Check your inventory against the advisory this week, patch Node.js first, and watch the 11 November Node.js release.

What to do now — and the 10 November deadline

There is no price here — this is a security advisory, not a product. The actions are free and the order matters. First, patch Node.js: move to 22.23.4, 24.22.1 or 26.12.1 (or later), internet-facing servers first, then rebuild container images that embed the runtime. Second, check the Cisco advisory for every Cisco product you run — Duo Network Gateway 3.4.2 and Spaces 24.22.1 are already fixed, and Webex Connect 6.22.2 and the Duo Authentication Proxy 6.8.1 are due in November. Third, for Catalyst Center and the products with no fix date, read the Cisco bug record for workarounds now rather than waiting. Fourth, plan a second patch window: the Node.js project ships another security release on or shortly after 11 November, with High-rated fixes for the same three lines. This post will be updated in place if Cisco confirms IOS XR or ASA as affected, or when the November Node.js release lands.

FAQs

Which Cisco products are affected by the Node.js Brotli vulnerabilities?
Cisco's advisory lists Catalyst Center, Duo Network Gateway, Duo Authentication Proxy Local Manager, Packet Tracer, Webex Connect, Spaces, Secure Endpoint Private Cloud Appliance, Intersight, Smart PHY, Nexus 9000 in standalone NX-OS mode, Business Process Automation and others. Fix dates range from November 2026 to July 2027; some products still have no date. Check the advisory's per-product bug records for the exact status of your product.

Is Cisco IOS XE affected by CVE-2026-111497?
No. Cisco has confirmed IOS XE is not impacted, along with Identity Services Engine, Catalyst SD-WAN, Secure Firewall Management Center and Threat Defense, Secure Client and the Meraki line. IOS XR and Secure Firewall ASA are still under investigation as of the 4 November update.

What is the CISA deadline for CVE-2026-111497?
CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October 2026, with a remediation deadline of 10 November 2026 for US federal civilian agencies. The deadline reflects confirmed exploitation, not a theoretical risk — and it is a useful target date for everyone else too.

How do I check if my Node.js version is vulnerable?
Run node --version. You are affected if you run 22.x before 22.23.4, 24.x before 24.22.1, or 26.x before 26.12.1. Upgrade to the fixed release or later. Node.js 20.x and older lines receive no security updates, so those must be upgraded to a supported line. Note that standard npm audit scans will not flag these flaws, because they sit inside the runtime binaries, not in package dependencies.

Takeaway: Cisco's updated advisory turns the Node2Shell flaw from a Node.js problem into a Cisco inventory problem: most flagship network software is clear, but Catalyst Center, Duo, Webex and a dozen other products need patches — and the CISA clock runs out on 10 November.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

TechByCountry — Daily Tech News, Country by Country

Search This Blog