Threats tagged 'bit-node-2026-106069'

A vulnerability in Node.js TLS hostname verification allows a server certificate to be validated against a different IP address than the one the client connected to when the host is specified as a non-canonical IPv4 literal with a leading zero. This occurs because Node.js normalizes the host using WHATWG URL rules interpreting leading-zero octets as octal, while some operating systems interpret them as decimal. This mismatch can cause a server at one IP to be authenticated with a certificate issued for another IP. The flaw affects Node.js versions 22.x, 24.x, and 26.x prior to their respective fixed releases.