CVE-2026-106072Medium· 6.7▾ TwilightPoC availableA flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling (for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1), tls.checkServerIdentity() may fail to classify the host …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 36.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
1 GitHub repo
Last analysed / modified upstream
0.3% → 0.5%
A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling (for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1), tls.checkServerIdentity() may fail to classify the host as an IP address, normalize it to a canonical form, and match that form against certificate DNS SANs instead of requiring an IP Address SAN. A certificate that contains a DNS SAN equal to the canonical IP string (for example DNS:127.0.0.1) without a corresponding IP Address SAN can therefore be accepted for an IP endpoint. Exploitation requires a certificate with such a numeric DNS SAN that is trusted by the client, and a platform resolver that accepts the non-canonical spelling (glibc does).
nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification — rated Moderate by Red Hat. Released 2026-10-23, updated 2026-10-26.
Affected:
No fix planned:
Not affected:
Fix deferred
Workarounds / mitigations:
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105483High· 7.4nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
CVE-2026-106069High· 7.4nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
CVE-2026-106073Low· 3.3nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
CVE-2026-106074Medium· 4.8nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
CVE-2026-105481Medium· 6.5nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
CVE-2026-105482High· 7.4nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)