CVE-2026-105483
Published: October 24, 2026Last modified: November 1, 2026
Description
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.4 |
| Attack Vector | NETWORK |
| Attack complexity | HIGH |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity impact | HIGH |
| Availability impact | NONE |
| Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | nodejs | Unknown (18.16.0-r0) |
| 25 LTS | nodejs | Unknown (22.16.0-r1) | |
| nodejs22 | Unknown (22.23.2-r1) | ||
| nodejs24 | Fixed (24.22.1-r0) | ||
| nodejs26 | Fixed (26.12.1-r0) | ||
| Stream | nodejs | Unknown (18.16.1-r0) | |
| nodejs22 | Unknown (22.23.2-r0) | ||
| nodejs24 | Fixed (24.22.1-r0) | ||
| nodejs26 | Fixed (26.12.1-r1) | ||
| Hardened Containers | 23 LTS | nodejs | Unknown (18.16.0-r0) |
| 25 LTS | nodejs | Unknown (22.16.0-r1) | |
| nodejs22 | Unknown (22.23.2-r1) | ||
| nodejs24 | Fixed (24.22.1-r0) | ||
| nodejs26 | Fixed (26.12.1-r0) | ||
| Stream | nodejs | Unknown (18.16.1-r0) | |
| nodejs22 | Unknown (22.23.2-r0) | ||
| nodejs24 | Fixed (24.22.1-r0) | ||
| nodejs26 | Fixed (26.12.1-r1) |