Threats tagged 'bit-node-2026-105483'

A vulnerability in Node.js TLS hostname verification allows a certificate without a matching IP address Subject Alternative Name (SAN) to authenticate a connection to an IPv4 address when the host is represented with non-ASCII characters such as fullwidth digits. This occurs because the tls.checkServerIdentity() function fails to recognize such hosts as IP addresses and instead matches them against DNS names and Common Name fields in the certificate. This flaw affects Node.js versions 24.x and 26.x and was introduced as a regression after a previous fix. Fixed versions are 24.22.1 and 26.12.1.