A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint…
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited · CVSS 6.7 Medium.
Data as of 10/25/2026, 12:14:33 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Security Response Center Microsoft | Affected
| Fixed in– |
AI-suggested
Until a fix is available, users should be cautious when relying on TLS hostname verification for IP endpoints in Node.js 3.0 and consider additional validation controls if possible.
Description
A vulnerability in Node.js TLS hostname verification allows a certificate containing only a DNS Subject Alternative Name (SAN) to authenticate an IP endpoint improperly. This flaw could lead to incorrect validation of TLS connections when IP addresses are used instead of hostnames.
Impact
This vulnerability may allow an attacker to present a certificate with a DNS SAN and have it accepted as valid for an IP address endpoint, potentially enabling man-in-the-middle attacks or unauthorized access if TLS connections rely on hostname verification for security. However, there is no indication of known exploits in the wild at this time.
Summary
The vulnerability identified as CVE-2026-106072 affects Node.js version 3.0. It involves a flaw in the TLS hostname verification process where a certificate that includes only a DNS SAN can be used to authenticate an IP endpoint. This means that the TLS client may accept a certificate as valid for an IP address even though the certificate does not explicitly include the IP address in its SAN fields, violating proper hostname verification rules. The weakness is related to CWE-295 (Improper Certificate Validation). No CVSS score or detailed exploit information is provided.
Weaknesses
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.