CVE-2026-106072
published 2026-10-23CVE-2026-106072: A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a…
PriorityP339medium6.7CVSS 3.0
AVNACLPRHUINSUCHIHAL
EPSS
0.55%
45.7th percentile
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | node | 22.23.3 – 22.23.3 | — |
| nodejs | node | 24.22.0 – 24.22.0 | — |
| nodejs | node | 26.12.0 – 26.12.0 | — |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
CVSS provenance
nvdv3.06.7MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
vendor_redhat6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification
vendor_redhat·2026-10-23·CVSS 6.7
CVE-2026-106072 [MEDIUM] CWE-295 nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification
nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts th
Fortinet
Multiple Node.js CVEs
vendor_fortinet·CVSS 6.5
CVE-2026-105482 [MEDIUM] Multiple Node.js CVEs
FG-IR-26-187: Multiple Node.js CVEs
CVSSv3 Score:
9.8
CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 -
VulDB
Node.js up to 22.23.3/24.22.0/26.12.0 TLS Hostname Verification tls.checkServerIdentity certificate validation
vuldb·2026-10-23·CVSS 6.7
CVE-2026-106072 [MEDIUM] Node.js up to 22.23.3/24.22.0/26.12.0 TLS Hostname Verification tls.checkServerIdentity certificate validation
A vulnerability was found in Node.js up to 22.23.3/24.22.0/26.12.0. It has been classified as problematic. Affected by this vulnerability is the function tls.checkServerIdentity of the component TLS Hostname Verification. Performing a manipulation results in improper certificate validation.
This vulnerability is reported as CVE-2026-106072. The attack is possible to be carried out remotely. No exploit exists.
GHSA
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`,
ghsa_unreviewed·2026-10-23
CVE-2026-106072 [MEDIUM] CWE-295 A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`,
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.
This vulnerability affects Node.js **26.x**, **24.x*
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-106072 nodejs24: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-rawhide]
bugzilla·2026-10-26·CVSS 6.7
CVE-2026-106072 [MEDIUM] CVE-2026-106072 nodejs24: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-rawhide]
CVE-2026-106072 nodejs24: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1`
Bugzilla
CVE-2026-106072 nodejs22: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-rawhide]
bugzilla·2026-10-26·CVSS 6.7
CVE-2026-106072 [MEDIUM] CVE-2026-106072 nodejs22: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-rawhide]
CVE-2026-106072 nodejs22: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1`
Bugzilla
CVE-2026-106072 nodejs22: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-44]
bugzilla·2026-10-26·CVSS 6.7
CVE-2026-106072 [MEDIUM] CVE-2026-106072 nodejs22: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-44]
CVE-2026-106072 nodejs22: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and
Bugzilla
CVE-2026-106072 nodejs22: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-43]
bugzilla·2026-10-26·CVSS 6.7
CVE-2026-106072 [MEDIUM] CVE-2026-106072 nodejs22: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-43]
CVE-2026-106072 nodejs22: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and
Bugzilla
CVE-2026-106072 nodejs24: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-43]
bugzilla·2026-10-26·CVSS 6.7
CVE-2026-106072 [MEDIUM] CVE-2026-106072 nodejs24: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-43]
CVE-2026-106072 nodejs24: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and
Bugzilla
CVE-2026-106072 nodejs24: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-44]
bugzilla·2026-10-26·CVSS 6.7
CVE-2026-106072 [MEDIUM] CVE-2026-106072 nodejs24: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-44]
CVE-2026-106072 nodejs24: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and
Bugzilla
CVE-2026-106072 nodejs26: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-rawhide]
bugzilla·2026-10-26·CVSS 6.7
CVE-2026-106072 [MEDIUM] CVE-2026-106072 nodejs26: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-rawhide]
CVE-2026-106072 nodejs26: nodejs: Authentication bypass via non-canonical IPv4 hostname verification [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1`
Bugzilla
CVE-2026-106072 nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification
bugzilla·2026-10-23·CVSS 6.7
CVE-2026-106072 [MEDIUM] CVE-2026-106072 nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification
CVE-2026-106072 nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolve
2026-10-23
Published