CVE-2026-105483
Node.js Vulnerability in NetApp Products
CVE-2026-105483: Node.js Vulnerability in NetApp Products. Not in the CISA KEV catalog. Critical advisory severity (CVSS 7.4, NetApp).
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Get an email when Cisco publishes the next one.
VulniPulse checks Cisco's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
CVE-2026-105483 key facts
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Critical
- CVSS base score
- 7.4 (NetApp), 7.4 (Red Hat)
- Weakness
- CWE-297
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-105483; bulletin-wide values are not repeated here.
Is CVE-2026-105483 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-105483 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-105483?
- To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks. (Red Hat)
Vendor advisory comparison
Cisco
1 advisory- Advisory severityCritical
Critical [CVE-2026-105482 +3] Vulnerabilities in node.js Affecting Cisco Products: October 2026
cisco-sa-oct2026-node-js-Jj3SQ19uSource published
This bulletin covers 4 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release. The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory: - CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution - CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters - CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits - CVE-2026-106069 -…
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Workarounds
- Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products section of this advisory.
Fortinet
1 advisory- Advisory severityCritical9.8
Critical [CVE-2026-105481 +9] Multiple Node.js CVEs
FG-IR-26-187Source published Source updated
This bulletin covers 10 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 - (low)This vulnerability affects…
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
NetApp
1 advisory- Advisory severityHigh7.4
High [CVE-2026-105483] Node.js Vulnerability in NetApp Products
NTAP-20261023-0003Source published Source updated
Node.js versions 24.x prior to 24.22.1 and 26.x prior to 26.12.1 are susceptible to a vulnerability which when successfully exploited could allow a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (１２７.0.0.1). Successful exploitation of this vulnerability could lead to disclosure of sensitive information or addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- 24.22.1
- 26.12.1
- 0.0.1
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Red Hat
1 advisory- Advisory severityHigh7.4
High [CVE-2026-105483] TLS certificate hostname bypass via fullwidth-digit IP hostnames
CVE-2026-105483Source published Source updated
TLS certificate hostname bypass via fullwidth-digit IP hostnames. Red Hat rates this important (CVSS 7.4). Weakness: CWE-297. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; and 2 more.
- Related products — impact not confirmed
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
2 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks.
More Cisco advisories
- cisco-sa-emudhra-info-ScS22A1rOct 23, 2026Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate
- CVE-2026-109618Oct 21, 2026Vulnerabilities in PHP Affecting Cisco Products: October 2026
- CVE-2026-76445Oct 21, 2026Multiple Cisco Products Snort 3 Denial of Service Vulnerability
- CVE-2026-76462Oct 21, 2026Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability
- CVE-2026-20221Oct 21, 2026Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service
- CVE-2026-76524Oct 21, 2026Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
Follow CVE-2026-105483 in the free weekly digest
Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Get alerts for new CVEs on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.