CVE-2026-106072: CWE-295 Improper Certificate Validation in nodejs node

CVE-2026-106072 is a vulnerability in Node.js TLS hostname verification (CWE-295) affecting versions 22.23.3, 24.22.0, and 26.12.0. The flaw allows a certificate containing only a DNS SAN with a numeric IP address to authenticate an IP endpoint when the client connects using non-canonical IPv4 spellings such as octal, hexadecimal, or integer formats. The function tls.checkServerIdentity() fails to classify these hosts as IP addresses and instead normalizes them to canonical form and matches against DNS names. This leads to acceptance of certificates with DNS:127.0.0.1 but no IP Address SAN for 127.0.0.1, which should be rejected. Exploitation requires a certificate from a trusted CA and a platform resolver like glibc that accepts these non-canonical IP spellings.

Successful exploitation allows an attacker with a certificate containing a numeric DNS SAN issued by a trusted CA to impersonate an IP endpoint when clients connect using non-canonical IPv4 address formats. This can lead to a high impact on confidentiality and integrity, as TLS connections may be improperly authenticated. Availability impact is low. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using non-canonical IPv4 address formats when connecting to TLS endpoints in affected Node.js versions. Monitor vendor channels for updates and apply patches once released.