---
id: "CVE-2026-105483"
kind: "vulnerability"
aliases: ["CVE-2026-105483"]
title: "Node.js: fullwidth-digit IP hosts bypass TLS certificate hostname checks"
severity: "high"
cvss: 7.4
epss: 0.00238
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["node.js", "poc-public", "runtime", "self-hosted", "tls"]
not_affected_if: ["default-config"]
published_at: "2026-10-23T17:17:19+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105483", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "github-poc", "url": "https://github.com/CompleteTech-LLC/node-cve-2026-105483-check", "first_seen_at": "2026-10-23T23:55:02+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-105483", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Node.js: fullwidth-digit IP hosts bypass TLS certificate hostname checks

Node.js tls.checkServerIdentity() fails to recognize IPv4 hosts written with non-ASCII digits such as fullwidth characters, and matches them against DNS names and Common Name instead. An attacker holding a certificate for a DNS name like 127.0.0.1 or *.0.0.1 can impersonate an IP endpoint that certificate was never issued for.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `node --version` and check whether it reports a 26.x or 24.x release.
- Check whether the application uses `tls.connect` or `https` with certificate verification against IP-address endpoints.
- Look for `checkServerIdentity` overrides in the code base.

## Fix

- Upgrade Node.js 26.x and 24.x to the patched release named in the Node.js security advisory (version unknown from the sources).
- Until patched, avoid relying on hostname verification for IP-address endpoints from untrusted certificate sources.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105483
- 2026-10-23T23:55:02+00:00 github-poc https://github.com/CompleteTech-LLC/node-cve-2026-105483-check
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-105483

## Documents

- [poc] CompleteTech-LLC/node-cve-2026-105483-check https://github.com/CompleteTech-LLC/node-cve-2026-105483-check

## From the sources

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).

`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.

This vulnerability affects Node.js **26.x** and **24.x**.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_