Node.js TLS Hostname Verification Flaw Impacting Multiple Versions

CVE-2026-106069

What is CVE-2026-106069?

A vulnerability exists in Node.js related to TLS hostname verification that can lead to improper validation of server certificates. Specifically, when a server is accessed via a non-canonical IPv4 address with a leading zero (e.g., 0127.0.0.1), the certificate may be validated against an incorrect IP address. This occurs because the tls.checkServerIdentity() function applies normalization rules that interpret leading-zero octets as octal numbers, which can cause discrepancies with how the address is resolved at the operating system level. Consequently, this can result in a scenario where a client connects to a server expecting a specific certificate, but ends up being authenticated with a certificate meant for a different address. Such discrepancies pose significant security risks for any implementation relying on these versions of Node.js.

References