CVE-2026-105482 +3 CVEs: Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026
This Splunk advisory covers CVE-2026-105482 and CVE-2026-105483 and 2 more CVEs in Splunk Enterprise, Splunk Visual Exporter and Splunk SOAR Automation Broker. Its rating, versions and guidance apply to the bulletin as a whole, not to each of its 4 CVEs.
Key facts
- CISA KEV
- CVE-2026-111497 is listed ()
- Advisory id
- SVD-2026-1015
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
CVE-2026-111497 in the CISA Known Exploited Vulnerabilities catalog
- CISA name:
- Google Brotli Unchecked Return Value Vulnerability
- CISA description:
- Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
- Required action:
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Description
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation.
The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release.
The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory: * CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution * CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters * CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits * CVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addresses Splunk is investigating to determine which products may be affected by these vulnerabilities.
As the investigation progresses, Splunk will update this advisory with information about affected products.
Affected products named by the advisory: Splunk Enterprise; Splunk Visual Exporter; Splunk SOAR Automation Broker; Splunk UBA; and 9 more.
Affected products named by the advisory: Splunk Attack Analyzer; Python for Scientific Computing; AppDynamics SaaS; AppDynamics On-Premises; and 5 more.
Text from the source record.
Fix and mitigation
Vendor guidance
- As the investigation progresses, Splunk will update this advisory with information about affected products.
End-of-life dates for Splunk Enterprise
More Splunk advisories
CVE-2026-76302Oct 21, 2026Splunk: As part of Cisco's ongoing commitment to proactive security and product qualityCVE-2026-76301Oct 21, 2026Splunk: As part of Cisco's ongoing commitment to proactive security and product qualityCVE-2026-76300Oct 21, 2026Splunk: As part of Cisco's ongoing commitment to proactive security and product qualityCVE-2026-76299Oct 21, 2026Splunk: As part of Cisco's ongoing commitment to proactive security and product qualityCVE-2026-76298Oct 21, 2026In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not holdCVE-2026-76297Oct 21, 2026In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16
Get an email when Splunk Enterprise publishes the next one.
See Splunk Enterprise's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Splunk CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
