CVE-2026-106072
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.0 vector| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | H | Administrator |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | H | High |
| Integrity I | H | High |
| Availability A | L | Low |
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Description
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 3.0 | 6.7 MEDIUM | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L |
| CNA / hackerone | 3.0 | 6.7 MEDIUM | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| nodejs | node | affected: 22.23.3 … <= 22.23.3 affected: 24.22.0 … <= 24.22.0 affected: 26.12.0 … <= 26.12.0 default: unaffected |
Linux distribution status
Red Hat ↗ Fetching
Debian ↗
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bookworm | nodejs | open not yet assigned | |
| forky | nodejs | open not yet assigned | |
| sid | nodejs | open not yet assigned | |
| trixie | nodejs | open not yet assigned |
Ubuntu ↗ medium
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bionic | nodejs | needs-triage | |
| focal | nodejs | needs-triage | |
| jammy | nodejs | needs-triage | |
| noble | nodejs | needs-triage | |
| resolute | nodejs | needs-triage | |
| stonking | nodejs | needs-triage | |
| trusty | nodejs | needs-triage | |
| xenial | nodejs | needs-triage |