CVE-2026-106069: CWE-295 Improper Certificate Validation in nodejs node

CVE-2026-106069 describes an improper certificate validation vulnerability in Node.js TLS hostname verification. The function tls.checkServerIdentity() normalizes hostnames following WHATWG URL rules, interpreting leading-zero octets in IPv4 addresses as octal numbers (e.g., '0127.0.0.1' becomes '87.0.0.1'). However, the operating system resolver, such as on macOS, interprets these octets as decimal (e.g., '127.0.0.1'). This mismatch can cause a server certificate to be validated against an IP address different from the one the client connected to, allowing a server at the connected address to be authenticated with a certificate issued for another IP address. The vulnerability affects Node.js versions 22.23.3, 24.22.0, and 26.12.0.

This vulnerability can lead to a high-severity impact where a client may incorrectly trust a server certificate that does not match the actual server IP address it connected to. This undermines the TLS authentication process, potentially enabling man-in-the-middle attacks or impersonation of trusted servers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Node.js vendor advisories for updates addressing this issue and avoid using non-canonical IPv4 literals with leading zeros in hostnames until a fix is available.