CVE-2026-106069High· 7.4▾ MidnightPoC availableA flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause c…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Last analysed / modified upstream
1 GitHub repo
0.2%
0.2% → 0.3%
A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not identify the peer that was actually connected, allowing server impersonation.
nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-23.
Affected:
No fix planned:
Not affected:
Affected
Workarounds / mitigations:
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105483High· 7.4nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
CVE-2026-105482High· 7.4nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
CVE-2026-106073Low· 3.3nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
CVE-2026-106074Medium· 4.8nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
CVE-2026-105481Medium· 6.5nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)