CVE-2026-105483
published 2026-10-23CVE-2026-105483: A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the…
PriorityP345high7.4CVSS 3.0
AVNACHPRNUINSUCHIHAN
EPSS
0.27%
19.8th percentile
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).
`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.
This vulnerability affects Node.js **26.x** and **24.x**.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | node | 24.22.0 – 24.22.0 | — |
| nodejs | node | 26.12.0 – 26.12.0 | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
CVSS provenance
nvdv3.07.4HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Node.js up to 24.22.0/26.12.0 TLS Hostname Verification tls.checkServerIdentity certificate validation
vuldb·2026-10-23·CVSS 7.4
CVE-2026-105483 [HIGH] Node.js up to 24.22.0/26.12.0 TLS Hostname Verification tls.checkServerIdentity certificate validation
A vulnerability has been found in Node.js up to 24.22.0/26.12.0 and classified as problematic. This impacts the function tls.checkServerIdentity of the component TLS Hostname Verification. This manipulation causes improper certificate validation.
This vulnerability is registered as CVE-2026-105483. Remote exploitation of the attack is possible. No exploit is available.
GHSA
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, s
ghsa_unreviewed·2026-10-23·CVSS 6.5
CVE-2026-105483 [MEDIUM] CWE-295 A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, s
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).
`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.
This vulnerability affects Node.js **26.x** and **24.x**.
Red Hat
nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
vendor_redhat·2026-10-21·CVSS 7.4
CVE-2026-105483 [HIGH] CWE-297 nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).
`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.
This vulnerability affects Node.js **26.x** and **24.x**.
A flaw was
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-105483 nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105483 [HIGH] CVE-2026-105483 nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
CVE-2026-105483 nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
A flaw was found in Node.js. A regression in TLS IP hostname normalization allows a host written with fullwidth Unicode digits to bypass certificate hostname verification in checkServerIdentity. A TLS client can be made to accept a certificate that does not properly identify the requested IP address when connecting with such a hostname, enabling server impersonation.
Bugzilla
CVE-2026-105483 nodejs24: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-43]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105483 [HIGH] CVE-2026-105483 nodejs24: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-43]
CVE-2026-105483 nodejs24: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. A regression in TLS IP hostname normalization allows a host written with fullwidth Unicode digits to bypass certificate hostname verification in checkServerIdentity. A TLS client can be made to accept a certificate that does not properly identify the requested IP address when connecting with such a hostname, enabling server impersonation.
Bugzilla
CVE-2026-105483 nodejs26: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105483 [HIGH] CVE-2026-105483 nodejs26: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-rawhide]
CVE-2026-105483 nodejs26: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. A regression in TLS IP hostname normalization allows a host written with fullwidth Unicode digits to bypass certificate hostname verification in checkServerIdentity. A TLS client can be made to accept a certificate that does not properly identify the requested IP address when connecting with such a hostname, enabling server impersonation.
Bugzilla
CVE-2026-105483 nodejs24: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-44]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105483 [HIGH] CVE-2026-105483 nodejs24: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-44]
CVE-2026-105483 nodejs24: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. A regression in TLS IP hostname normalization allows a host written with fullwidth Unicode digits to bypass certificate hostname verification in checkServerIdentity. A TLS client can be made to accept a certificate that does not properly identify the requested IP address when connecting with such a hostname, enabling server impersonation.
Bugzilla
CVE-2026-105483 nodejs24: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105483 [HIGH] CVE-2026-105483 nodejs24: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-rawhide]
CVE-2026-105483 nodejs24: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. A regression in TLS IP hostname normalization allows a host written with fullwidth Unicode digits to bypass certificate hostname verification in checkServerIdentity. A TLS client can be made to accept a certificate that does not properly identify the requested IP address when connecting with such a hostname, enabling server impersonation.
Hackernews
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
blogs_hackernews·2026-10-22
CVE-2026-106069 Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix
2026-10-23
Published