Threats tagged 'bit-node-2026-106072'

A vulnerability in Node.js TLS hostname verification allows a certificate with only a DNS Subject Alternative Name (SAN) containing a numeric IP address to authenticate an IP endpoint when the client connects using non-canonical IPv4 address formats. This occurs because the function tls.checkServerIdentity() normalizes non-canonical IP addresses to their canonical form and matches them against DNS names in the certificate, incorrectly accepting certificates with DNS SANs for numeric IPs. The flaw affects Node.js versions 22.x, 24.x, and 26.x prior to specific fixed releases.