TLS Hostname Verification Flaw in Node.js by OpenJS Foundation

CVE-2026-106072

What is CVE-2026-106072?

A vulnerability in Node.js's TLS hostname verification mechanism allows a certificate with only a DNS Subject Alternative Name (SAN) to improperly authenticate an IP endpoint. Specifically, when clients connect using non-standard IPv4 address representations (such as 0177.0.0.1 or 0x7f.0.0.1), the tls.checkServerIdentity() function fails to identify these as IP addresses. Instead, it normalizes them to their canonical form, erroneously matching them against certificate DNS names. This flaw enables the acceptance of a certificate containing DNS:127.0.0.1 without the corresponding IP Address:127.0.0.1 SAN, leading to potential exploitation if a numeric DNS SAN certificate is issued by a trusted Certificate Authority (CA) and if a platform resolver like glibc processes these representations.

References