Search: CVE-2026-106072

Node.js versions 22.x, 24.x, and 26.x contain a vulnerability in TLS hostname verification where certificates with only a DNS Subject Alternative Name (SAN) can improperly authenticate IP endpoints when clients use non-canonical IPv4 address spellings. This occurs because the function tls.checkServerIdentity() normalizes these IP addresses and matches them against DNS names in the certificate, allowing a certificate with DNS:127.0.0.1 but no IP Address SAN to be accepted for connections to 127.0.0.1. Exploitation requires a trusted CA-issued certificate with a numeric DNS SAN and a platform resolver that accepts non-canonical IP spellings, such as glibc.