CVE-2026-106069
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.0 vectorThis vulnerability may be exploitable over the internet without authentication or user interaction.
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | H | High (conditions required) |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | H | High |
| Integrity I | H | High |
| Availability A | N | None |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 3.0 | 7.4 HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA / hackerone | 3.0 | 7.4 HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| nodejs | node | affected: 22.23.3 … <= 22.23.3 affected: 24.22.0 … <= 24.22.0 affected: 26.12.0 … <= 26.12.0 default: unaffected |
Linux distribution status
Red Hat ↗ important
This issue is rated Important. Exploitation requires a Node.js TLS client to connect using a non-canonical numeric hostname that normalizes to an IP address for certificate matching while name resolution uses a different interpretation, and a certificate that includes an IP subjectAltName matching the normalized address. Attack Complexity is High due to these prerequisites and the need to influence the connection target or traffic. Confidentiality and Integrity are High for a successful impersonation of a TLS peer; Availability is not affected. Upstream rates this High and fixed it in Node.js 22.23.4, 24.22.1, and 26.12.1.
Mitigation: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| Red Hat Hardened Images | hi/nodejs | not affected | |
| Red Hat Hardened Images | nodejs20 | not affected | |
| Red Hat Enterprise Linux 10 | nodejs22 | affected | |
| Red Hat Hardened Images | nodejs22 | not affected | |
| Red Hat Enterprise Linux 10 | nodejs24 | affected | |
| Red Hat Hardened Images | nodejs24 | not affected | |
| Red Hat Hardened Images | nodejs25 | not affected | |
| Red Hat Enterprise Linux 10 | nodejs26 | affected | |
| Red Hat Hardened Images | nodejs26 | not affected | |
| Red Hat Enterprise Linux 8 | nodejs:22/nodejs | affected | |
| Red Hat Enterprise Linux 9 | nodejs:22/nodejs | affected | |
| Red Hat Enterprise Linux 8 | nodejs:24/nodejs | affected | |
| Red Hat Enterprise Linux 9 | nodejs:24/nodejs | affected | |
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | affected |
Debian ↗
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bookworm | nodejs | open not yet assigned | |
| forky | nodejs | open not yet assigned | |
| sid | nodejs | open not yet assigned | |
| trixie | nodejs | open not yet assigned |
Ubuntu ↗ medium
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bionic | nodejs | needs-triage | |
| focal | nodejs | needs-triage | |
| jammy | nodejs | needs-triage | |
| noble | nodejs | needs-triage | |
| resolute | nodejs | needs-triage | |
| stonking | nodejs | needs-triage | |
| trusty | nodejs | needs-triage | |
| xenial | nodejs | needs-triage |