Live › vulnerability › CVE-2026-105483
Go to dashboardNode.js tls.checkServerIdentity() fails to recognize IPv4 hosts written with non-ASCII digits such as fullwidth characters, and matches them against DNS names and Common Name instead. An attacker holding a certificate for a DNS name like 127.0.0.1 or *.0.0.1 can impersonate an IP endpoint that certificate was never issued for.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications running Node.js 26.x or 24.x that open TLS connections to IPv4 addresses and accept certificates from parties that can obtain DNS-named certificates. Exposure depends on the client verifying the server, so servers that only accept client connections are less exposed. Teams on other Node.js lines can skip it.
No product ranges from the sources yet.
node --version and check whether it reports a 26.x or 24.x release.tls.connect or https with certificate verification against IP-address endpoints.checkServerIdentity overrides in the code base.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (１２７.0.0.1).
tls.checkServerIdentity() did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing DNS:127.0.0.1 or DNS:*.0.0.1 could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.
This vulnerability affects Node.js 26.x and 24.x.
This page as .md · .json · in your agent: get_signal("CVE-2026-105483")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.