CVE-2026-105483
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.0 vectorThis vulnerability may be exploitable over the internet without authentication or user interaction.
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | H | High (conditions required) |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | H | High |
| Integrity I | H | High |
| Availability A | N | None |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 3.0 | 7.4 HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA / hackerone | 3.0 | 7.4 HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| nodejs | node | affected: 24.22.0 … <= 24.22.0 affected: 26.12.0 … <= 26.12.0 default: unaffected |
Linux distribution status
Red Hat ↗ important
This issue is rated Important. Exploitation requires a Node.js TLS client to connect using a hostname that contains fullwidth Unicode digits which normalize to an IPv4 address, together with a certificate that satisfies the incorrect matching behavior. Attack Complexity is High because the attacker must influence the host string used for the connection (for example a user-supplied URL) and present a suitable certificate, typically with a privileged network position relative to that connection. Confidentiality and Integrity are High because a successful bypass enables server impersonation and exposure or alteration of TLS application data; Availability is not affected. This flaw affects Node.js 24.x and 26.x lines and does not affect the 22.x line per the upstream advisory.
Mitigation: To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks.
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| Red Hat Hardened Images | hi/nodejs | not affected | |
| Red Hat Hardened Images | nodejs20 | not affected | |
| Red Hat Enterprise Linux 10 | nodejs22 | not affected | |
| Red Hat Hardened Images | nodejs22 | not affected | |
| Red Hat Enterprise Linux 10 | nodejs24 | affected | |
| Red Hat Hardened Images | nodejs24 | not affected | |
| Red Hat Hardened Images | nodejs25 | will not fix | |
| Red Hat Enterprise Linux 10 | nodejs26 | affected | |
| Red Hat Hardened Images | nodejs26 | not affected | |
| Red Hat Enterprise Linux 8 | nodejs:22/nodejs | not affected | |
| Red Hat Enterprise Linux 9 | nodejs:22/nodejs | not affected | |
| Red Hat Enterprise Linux 8 | nodejs:24/nodejs | affected | |
| Red Hat Enterprise Linux 9 | nodejs:24/nodejs | affected | |
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | affected |
Debian ↗
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bookworm | nodejs | open not yet assigned | |
| forky | nodejs | open not yet assigned | |
| sid | nodejs | open not yet assigned | |
| trixie | nodejs | open not yet assigned |
Ubuntu ↗ medium
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bionic | nodejs | needs-triage | |
| focal | nodejs | needs-triage | |
| jammy | nodejs | needs-triage | |
| noble | nodejs | needs-triage | |
| resolute | nodejs | needs-triage | |
| stonking | nodejs | needs-triage | |
| trusty | nodejs | needs-triage | |
| xenial | nodejs | needs-triage |