---
id: CVE-2026-106072
title: >-
  nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname
  verification (CVE-2026-106072)
summary: >-
  A flaw was found in Node.js TLS hostname verification. When a client connects
  using a non-canonical IPv4 hostname spelling (for example 0177.0.0.1,
  0x7f.0.0.1, 2130706433, or 127.1), tls.checkServerIdentity() may fail to
  classify the host …
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L'
cvssSource: vendor
cwe: CWE-295
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-10-23'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T11:03:11+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106072.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106072.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-106072'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2560022'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-106072'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106072'
  - url: 'https://nodejs.org/en/blog/vulnerability/october-2026-security-releases'
tags:
  - csaf
  - vex
  - red-hat
  - exploit-available
  - cve.org
epss: 0.00548
epssPercentile: 0.45726
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/CompleTetech-Security/node-cve-2026-106072-check'
  checkedAt: '2026-10-27T16:54:45.985Z'
exploitAvailable: true
ingestedAt: '2026-10-23T16:31:11.321Z'
---

## Overview

A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling (for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1), tls.checkServerIdentity() may fail to classify the host as an IP address, normalize it to a canonical form, and match that form against certificate DNS SANs instead of requiring an IP Address SAN. A certificate that contains a DNS SAN equal to the canonical IP string (for example DNS:127.0.0.1) without a corresponding IP Address SAN can therefore be accepted for an IP endpoint. Exploitation requires a certificate with such a numeric DNS SAN that is trusted by the client, and a platform resolver that accepts the non-canonical spelling (glibc does).

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106072.json)

**nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification** — rated Moderate by Red Hat. Released 2026-10-23, updated 2026-10-26.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat Hardened Images

## Remediation

Fix deferred

Workarounds / mitigations:

- Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html).
Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html).
Restrict which destinations Node.js workloads may reach with eg…