CVE-2026-106069
published 2026-10-23CVE-2026-106069: A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to…
PriorityP346high7.4CVSS 3.0
AVNACHPRNUINSUCHIHAN
EPSS
0.27%
19.8th percentile
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.
`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | node | 22.23.3 – 22.23.3 | — |
| nodejs | node | 24.22.0 – 24.22.0 | — |
| nodejs | node | 26.12.0 – 26.12.0 | — |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
CVSS provenance
nvdv3.07.4HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 li
ghsa_unreviewed·2026-10-23
CVE-2026-106069 [HIGH] CWE-295 A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 li
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.
`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
VulDB
Node.js prior 22.23.3/24.22.0/26.12.0 Hostname Verification tls.checkServerIdentity certificate validation
vuldb·2026-10-23·CVSS 7.4
CVE-2026-106069 [HIGH] Node.js prior 22.23.3/24.22.0/26.12.0 Hostname Verification tls.checkServerIdentity certificate validation
A vulnerability, which was classified as problematic, has been found in Node.js. The impacted element is the function tls.checkServerIdentity of the component Hostname Verification. The manipulation leads to improper certificate validation.
This vulnerability is listed as CVE-2026-106069. The attack may be initiated remotely. There is no available exploit.
It is advisable to upgrade the affected component.
Red Hat
nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
vendor_redhat·2026-10-21·CVSS 7.4
CVE-2026-106069 [HIGH] CWE-297 nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.
`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-106069 nodejs22: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-106069 [HIGH] CVE-2026-106069 nodejs22: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-rawhide]
CVE-2026-106069 nodejs22: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. Non-canonical numeric hostnames (for example 127.1 or 0127.0.0.1) can be normalized by domainToASCII() to one IPv4 address for certificate checks while the platform resolver connects to a different address. A TLS client may therefore accept a certificate that does not identify the connected peer, enabling server impersonation.
Bugzilla
CVE-2026-106069 nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-106069 [HIGH] CVE-2026-106069 nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
CVE-2026-106069 nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
A flaw was found in Node.js. Non-canonical numeric hostnames (for example 127.1 or 0127.0.0.1) can be normalized by domainToASCII() to one IPv4 address for certificate checks while the platform resolver connects to a different address. A TLS client may therefore accept a certificate that does not identify the connected peer, enabling server impersonation.
Bugzilla
CVE-2026-106069 nodejs24: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-106069 [HIGH] CVE-2026-106069 nodejs24: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-rawhide]
CVE-2026-106069 nodejs24: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. Non-canonical numeric hostnames (for example 127.1 or 0127.0.0.1) can be normalized by domainToASCII() to one IPv4 address for certificate checks while the platform resolver connects to a different address. A TLS client may therefore accept a certificate that does not identify the connected peer, enabling server impersonation.
Bugzilla
CVE-2026-106069 nodejs26: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-106069 [HIGH] CVE-2026-106069 nodejs26: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-rawhide]
CVE-2026-106069 nodejs26: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. Non-canonical numeric hostnames (for example 127.1 or 0127.0.0.1) can be normalized by domainToASCII() to one IPv4 address for certificate checks while the platform resolver connects to a different address. A TLS client may therefore accept a certificate that does not identify the connected peer, enabling server impersonation.
Bugzilla
CVE-2026-106069 nodejs24: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-43]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-106069 [HIGH] CVE-2026-106069 nodejs24: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-43]
CVE-2026-106069 nodejs24: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. Non-canonical numeric hostnames (for example 127.1 or 0127.0.0.1) can be normalized by domainToASCII() to one IPv4 address for certificate checks while the platform resolver connects to a different address. A TLS client may therefore accept a certificate that does not identify the connected peer, enabling server impersonation.
Bugzilla
CVE-2026-106069 nodejs24: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-44]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-106069 [HIGH] CVE-2026-106069 nodejs24: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-44]
CVE-2026-106069 nodejs24: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. Non-canonical numeric hostnames (for example 127.1 or 0127.0.0.1) can be normalized by domainToASCII() to one IPv4 address for certificate checks while the platform resolver connects to a different address. A TLS client may therefore accept a certificate that does not identify the connected peer, enabling server impersonation.
Bugzilla
CVE-2026-106069 nodejs22: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-43]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-106069 [HIGH] CVE-2026-106069 nodejs22: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-43]
CVE-2026-106069 nodejs22: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. Non-canonical numeric hostnames (for example 127.1 or 0127.0.0.1) can be normalized by domainToASCII() to one IPv4 address for certificate checks while the platform resolver connects to a different address. A TLS client may therefore accept a certificate that does not identify the connected peer, enabling server impersonation.
Bugzilla
CVE-2026-106069 nodejs22: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-44]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-106069 [HIGH] CVE-2026-106069 nodejs22: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-44]
CVE-2026-106069 nodejs22: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. Non-canonical numeric hostnames (for example 127.1 or 0127.0.0.1) can be normalized by domainToASCII() to one IPv4 address for certificate checks while the platform resolver connects to a different address. A TLS client may therefore accept a certificate that does not identify the connected peer, enabling server impersonation.
Hackernews
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
blogs_hackernews·2026-10-22
CVE-2026-106069 Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix
2026-10-23
Published