This vulnerability arises from a mismatch in how Node.js handles TLS hostname verification and Unicode dot separators, causing a wildcard-depth authentication bypass. The flaw affects all supported Node.js release lines 22, 24, and 26 as shipped in Red Hat products. The issue is classified under CWE-176 (Improper Handling of Unicode Encoding) and CWE-289 (Authentication Bypass by Alternate Name). Red Hat's advisory confirms the vulnerability and provides updated Node.js packages that fix the issue. The CVSS v3 base score is 7.7, indicating high severity, with network attack vector, low complexity, low privileges required, no user interaction, and a changed scope with high confidentiality impact but no integrity or availability impact.

The vulnerability allows an attacker to bypass TLS hostname verification due to improper Unicode dot separator handling, potentially leading to unauthorized access and compromise of confidentiality in applications using Node.js TLS connections. There is no reported impact on integrity or availability. No known exploits are reported in the wild at this time.

Red Hat has released updated Node.js packages (e.g., nodejs22-22.23.1) that address this vulnerability. Applying these official security updates is the recommended remediation. Currently, no alternative mitigations meet Red Hat's criteria for ease of use and stability. Users should upgrade affected Node.js versions to the patched releases provided by Red Hat. Check the vendor advisory for detailed update instructions.