All vulnerabilities
CVE-2026-106069

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 li

nodejs nodeRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
7.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 23 Oct 2026, 16:15 UTCPublishedCVE List
  2. 23 Oct 2026, 23:47 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1.

tls.checkServerIdentity() normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (0127.0.0.1 becomes 87.0.0.1), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (127.0.0.1). A server at the connected address can then be authenticated with a certificate issued for another IP address.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Text from CVE List

Affected versions 3

  • nodeaffected: 22.23.3 through 22.23.3CVE List
  • nodeaffected: 24.22.0 through 24.22.0CVE List
  • nodeaffected: 26.12.0 through 26.12.0CVE List

References 1