CVE-2026-106072
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
CVE-2026-106072
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-106072
node
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "nodejs",
"product": "node",
"versions": [
{
"status": "affected",
"version": "22.23.3",
"versionType": "semver",
"lessThanOrEqual": "22.23.3"
},
{
"status": "affected",
"version": "24.22.0",
"versionType": "semver",
"lessThanOrEqual": "24.22.0"
},
{
"status": "affected",
"version": "26.12.0",
"versionType": "semver",
"lessThanOrEqual": "26.12.0"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-106072
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #53072 · Revision 1
- Added to Heist Feed
- Publisher date