ManageEngine Says No Customer Impact from Node.js CVEs

In Short

ManageEngine assessed four high severity Node.js vulnerabilities and said it found no impact on customer data or product functionality.

The company said the affected Node.js version was only used in an internal build generation service. It also said the service was not exposed to the internet.

ManageEngine said it upgraded its Node.js build process to patched versions as a precaution, and that customers do not need to take any action.

What Happened: ManageEngine’s Review Of Four Node.js CVEs

Node.js announced security releases for the 26.x, 24.x, and 22.x release lines to fix multiple vulnerabilities affecting the Brotli decoder, DNS resolution, and TLS certificate validation. TLS is the security layer used to validate certificates and help protect traffic between systems.

ManageEngine’s update lists four vulnerabilities, all rated high severity. These include CVE-2026-111497, described as a Brotli decoder out-of-bounds write with potential remote code execution (running an attacker’s code on a system). It also includes CVE-2026-105482, a DNS resolution truncation issue involving embedded NUL characters.

Two of the issues relate to TLS hostname validation bypass. CVE-2026-105483 involves bypass using fullwidth IP digits and affects the 26.x and 24.x lines. CVE-2026-106069 involves bypass with non-canonical IP addresses and affects 26.x, 24.x, and 22.x.

ManageEngine said its security teams reviewed its products and supporting infrastructure after the disclosure. The company’s findings were that the affected Node.js version was used in an internal service for build generation, not used at runtime, and did not process customer traffic or data. It also said this internal service was not exposed to the internet.

Why It Matters

Node.js is widely used for software development and internet-facing services, so high severity issues that risk remote code execution or traffic interception can trigger urgent reviews.

ManageEngine’s statement matters for customers because it says no customer data impact was identified, no evidence of exploitation was found in its environment, and no customer action is required.

For questions, ManageEngine directed customers to contact its security team at security@manageengine.com.