TLS Hostname Verification Flaw in Node.js Affects Multiple Versions

CVE-2026-105483

What is CVE-2026-105483?

A security issue in Node.js allows improper TLS hostname verification, where certificates lacking a matching IP address Subject Alternative Name (SAN) can erroneously authenticate a connection. This occurs when using non-ASCII characters, such as fullwidth digits, which the verification process does not properly recognize as valid IP addresses. Instead of validating against the correct IP address, the system matches them with certificate DNS names and Common Names, potentially resulting in an accepted certificate that does not correspond to the intended IP endpoint. This flaw has been noted in both Node.js 26.x and 24.x versions.

References