{"id":"CVE-2026-106069","title":"nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)","summary":"A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause c…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"vendor","cwe":["CWE-297","CWE-295"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["enterprise_linux 10","enterprise_linux 8","enterprise_linux 9"],"published":"2026-10-21","updated":"2026-10-23","sourceUpdated":"2026-10-23T18:19:39+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106069.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106069.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-106069"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559873"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106069"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106069"},{"url":"https://nodejs.org/en/blog/release/v22.23.4"},{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"}],"tags":["csaf","vex","red-hat","exploit-available","cve.org"],"exploits":{"github":1,"githubRepos":["https://github.com/CompleTetech-Security/node-cve-2026-106069-check"],"checkedAt":"2026-10-27T16:54:45.980Z"},"exploitAvailable":true,"ingestedAt":"2026-10-23T16:31:11.319Z","epss":0.00275,"epssPercentile":0.19848,"slug":"CVE-2026-106069","body":"## Overview\n\nA flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not identify the peer that was actually connected, allowing server impersonation.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106069.json)\n\n**nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames** — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":228670,"id":"CVE-2026-106069","ts":1792844889575,"field":"exploit_available","old":"false","new":"true"}]}