Live › vulnerability › CVE-2026-106072
Go to dashboardNode.js's tls.checkServerIdentity() normalizes non-canonical IPv4 spellings such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 and 127.1, then matches them against certificate DNS names. A certificate with only a numeric DNS SAN, issued by a trusted CA, is accepted for the IP endpoint, so an attacker can impersonate that server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications running Node.js 22.x, 24.x or 26.x that connect to IP-addressed TLS endpoints and verify certificates with the default hostname check. Exploitation needs a certificate with a numeric DNS SAN issued by a CA the client trusts, and a platform resolver such as glibc that accepts these IPv4 spellings. Teams that only connect by DNS name, or use only non-glibc resolvers, are less exposed.
No product ranges from the sources yet.
node --version and check whether it starts with 22., 24. or 26.tls.checkServerIdentity() or relies on default hostname verification for connections to IP addressesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1.
tls.checkServerIdentity() did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing DNS:127.0.0.1 and no IP Address:127.0.0.1 SAN was therefore accepted, while the same certificate is correctly rejected for 127.0.0.1. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
This page as .md · .json · in your agent: get_signal("CVE-2026-106072")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.