{"id":"CVE-2026-105483","kind":"vulnerability","aliases":["CVE-2026-105483"],"related":[],"title":"Node.js: fullwidth-digit IP hosts bypass TLS certificate hostname checks","description":"A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).\n\n`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.\n\nThis vulnerability affects Node.js **26.x** and **24.x**.","summary":"Node.js tls.checkServerIdentity() fails to recognize IPv4 hosts written with non-ASCII digits such as fullwidth characters, and matches them against DNS names and Common Name instead. An attacker holding a certificate for a DNS name like 127.0.0.1 or *.0.0.1 can impersonate an IP endpoint that certificate was never issued for.","severity":"high","cvss":7.4,"epss":0.00238,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","poc-public","runtime","self-hosted","tls"],"not_affected_if":["default-config"],"how_to_check":"- Run `node --version` and check whether it reports a 26.x or 24.x release.\n- Check whether the application uses `tls.connect` or `https` with certificate verification against IP-address endpoints.\n- Look for `checkServerIdentity` overrides in the code base.","fix":"- Upgrade Node.js 26.x and 24.x to the patched release named in the Node.js security advisory (version unknown from the sources).\n- Until patched, avoid relying on hostname verification for IP-address endpoints from untrusted certificate sources.","status":"open","published_at":"2026-10-23T17:17:19+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:25:30+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:25:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js 26.x and 24.x to the patched release named in the Node.js security advisory (version unknown from the sources).\n- Until patched, avoid relying on hostname verification for IP-address endpoints from untrusted certificate sources.","reach":"network","title":"Node.js: fullwidth-digit IP hosts bypass TLS certificate hostname checks","impact":"medium","summary":"Node.js tls.checkServerIdentity() fails to recognize IPv4 hosts written with non-ASCII digits such as fullwidth characters, and matches them against DNS names and Common Name instead. An attacker holding a certificate for a DNS name like 127.0.0.1 or *.0.0.1 can impersonate an IP endpoint that certificate was never issued for.","category":"runtime","nicknames":[],"who_cares":["node.js","tls","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker impersonates an IP endpoint over TLS using a mis-scoped certificate","analyst_note":"Confirm the patched Node.js versions and whether the NVD record's CVSS 7.4 matches the advisory; the PoC repo is at github.com/CompleteTech-LLC/node-cve-2026-105483-check.","how_to_check":"- Run `node --version` and check whether it reports a 26.x or 24.x release.\n- Check whether the application uses `tls.connect` or `https` with certificate verification against IP-address endpoints.\n- Look for `checkServerIdentity` overrides in the code base.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Applications running Node.js 26.x or 24.x that open TLS connections to IPv4 addresses and accept certificates from parties that can obtain DNS-named certificates. Exposure depends on the client verifying the server, so servers that only accept client connections are less exposed. Teams on other Node.js lines can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":3546,"output_tokens":713,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105483':14A,17A '-2026':13A,16A,180C '-48618':181C '0.0.1':66B,116C,156C '127.0.0.1':64B,153C '24':189C '26':186C 'accept':160C 'address':91C,100C,125C,136C 'affect':184C 'allow':84C 'ascii':38B,109C 'attack':55B 'authent':94C 'bypass':7A 'certif':9A,58B,73B,86C,142C,150C 'charact':43B,110C 'check':11A 'common':51B,146C 'connect':96C 'contain':151C 'could':157C 'cve':12A,15A,179C 'digit':4A,39B,114C 'dns':48B,61B,143C,152C,155C 'endpoint':71B,164C 'even':126C 'fail':29B 'fix':177C 'flaw':78C 'fullwidth':3A,42B,113C 'fullwidth-digit':2A 'hold':56B 'host':6A,25B,33B,103C,122C 'hostnam':10A,82C 'imperson':68B 'instead':53B,148C 'introduc':174C 'ip':5A,70B,90C,124C,163C 'ipv4':32B,99C,135C 'issu':76B,168C 'like':63B 'match':45B,89C,138C 'name':49B,52B,62B,144C,147C 'never':75B 'node.js':1A,18B,27B,80C,185C 'non':37B,108C 'non-ascii':36B,107C 'normal':129C 'poc':20B 'poc-publ':19B 'public':21B 'recogn':31B,120C 'regress':173C 'regular':134C 'resolv':131C 'runtim':22B 'san':92C 'self':24B 'self-host':23B 'therefor':158C 'though':127C 'tls':8A,26B,81C 'tls.checkserveridentity':28B,117C 'verif':83C 'vulner':183C 'without':87C 'written':34B,105C 'x':187C,190C '１２７':115C","nicknames":[],"mitigations":[],"who_affected":"Applications running Node.js 26.x or 24.x that open TLS connections to IPv4 addresses and accept certificates from parties that can obtain DNS-named certificates. Exposure depends on the client verifying the server, so servers that only accept client connections are less exposed. Teams on other Node.js lines can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T17:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"support@hackerone.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-105483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105483","severity":null,"published_at":"2026-10-23T17:17:19+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"github-poc","external_id":"CompleteTech-LLC/node-cve-2026-105483-check","url":"https://github.com/CompleteTech-LLC/node-cve-2026-105483-check","severity":null,"published_at":"2026-10-23T23:47:01+00:00","modified_at":null,"first_seen_at":"2026-10-23T23:55:02+00:00","fetched_at":"2026-10-23T23:55:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105483","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105483","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":2246,"url":"https://github.com/CompleteTech-LLC/node-cve-2026-105483-check","title":"CompleteTech-LLC/node-cve-2026-105483-check","kind":"poc","source":"github","text":"Standalone defensive checker project for CVE-2026-105483: Node.js: TLS fullwidth-IP hostname validation bypass. One exploit per repository; implementation pending.\n\nstars 0","published_at":"2026-10-23T23:47:01+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}