Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026
cisco-sa-oct2026-node-js-Jj3SQ19u
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited.
To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID). Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
Security Impact Rating: Critical CVE: CVE-2026-20322,CVE-2026-20325,CVE-2026-20326,CVE-2026-20360,CVE-2026-20361,CVE-2026-76409
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID).
CVEs in this advisory 6
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- The vendor changed the advisory summary.
Updates
- Published by Cisco
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.