A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a…
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited · CVSS 7.4 High.
Data as of 10/25/2026, 12:14:24 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Security Response Center Microsoft | Affected
| Fixed in– |
AI-suggested
Until a fix is available, users should monitor official Microsoft or Node.js security advisories for updates. No specific mitigations are provided in the current data.
Description
A vulnerability in Node.js TLS hostname verification allows a certificate lacking a matching IP address Subject Alternative Name (SAN) to authenticate improperly. This flaw affects Node.js version 3.0. No CVSS score or detailed impact metrics are provided. No patch or remediation information is currently available. There is no evidence of exploitation in the wild at this time.
Impact
The impact is that TLS hostname verification may be bypassed when the certificate does not include a matching IP address SAN, potentially allowing unauthorized entities to authenticate. However, no active exploitation has been reported, and the extent of risk depends on the deployment context and usage of Node.js TLS features.
Summary
CVE-2026-105483 describes a security flaw in Node.js TLS hostname verification where a certificate without a matching IP address SAN can still authenticate successfully. This undermines the intended validation of TLS certificates, potentially allowing unauthorized authentication. The vulnerability is identified in Node.js version 3.0. No further technical details, CVSS score, or vendor advisory with patch information are provided.
Weaknesses
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.