A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited · CVSS 7.4 High.
Data as of 10/25/2026, 12:14:27 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Security Response Center Microsoft | Affected
| Fixed in– |
AI-suggested
Until a fix is available, users should exercise caution when using Node.js version 3.0 for TLS connections and monitor official Microsoft Security Response Center advisories for updates.
Description
A vulnerability in Node.js TLS hostname verification can cause a server certificate to be validated against an incorrect IP address. This flaw affects Node.js version 3.0. No CVSS score or exploit details are available. The issue relates to improper validation of server certificates during TLS connections.
Impact
The impact involves the possibility that a TLS server certificate is incorrectly validated against a mismatched IP address, which could allow an attacker to bypass hostname verification checks. This undermines the trust model of TLS connections, potentially enabling man-in-the-middle attacks if exploited. However, no known exploits are reported in the wild.
Weaknesses
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.