CVE-2026-105483: CWE-295 Improper Certificate Validation in nodejs node

CVE-2026-105483 is a vulnerability in Node.js TLS hostname verification affecting versions 24.22.0 and 26.12.0. The issue arises when an IPv4 address is written using non-ASCII characters (e.g., fullwidth digits like `１２７.0.0.1`). The function tls.checkServerIdentity() does not recognize these as IP addresses and instead matches them against DNS names or Common Names in the certificate. Consequently, a certificate containing DNS entries such as `DNS:127.0.0.1` or `DNS:*.0.0.1` could be accepted for an IP endpoint it was not issued for. This vulnerability is a regression introduced after the fix for CVE-2026-48618 and is classified under CWE-295 (Improper Certificate Validation).

An attacker could present a certificate with DNS names that do not correspond to the actual IP address but still be accepted by Node.js when the IP address is represented with non-ASCII characters. This improper validation can lead to man-in-the-middle attacks or unauthorized authentication, compromising confidentiality and integrity of TLS connections. The CVSS score of 7.4 (high) reflects the potential for significant impact on confidentiality and integrity without requiring user interaction or privileges.

The vulnerability affects specific Node.js versions 24.22.0 and 26.12.0. Since no patch links or vendor advisory content are provided, patch status is not yet confirmed — check the official Node.js security advisories for updates and remediation guidance. Until a fix is available, avoid using these specific Node.js versions or avoid connecting to hosts using non-ASCII character representations of IP addresses. Monitor vendor channels for official patches or updates.