CVE Feed

    Dashboard / CVE / CVE-2026-106072

    CVE-2026-106072

    A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

    Published:Oct 23, 2026
    Last Modified:Oct 23, 2026
    EPS:Oct 23, 2026
    EPSS Score:
    CVSS Score:6.7

    Affected Products

    Vendor
    Nodejs
    Product
    Nodejs

    Exploits

    https://github.com/completetech-security/node-cve-2026-106072-checkhttps://github.com/CompleTetech-Security/node-cve-2026-106072-check

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2026-106069 (CVSS 7.4) — A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different…
    CVE-2026-105481 (CVSS 6.5) — A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent b…
    CVE-2026-105482 (CVSS 7.4) — A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.re…
    CVE-2026-106074 (CVSS 4.8) — A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUI…
    CVE-2026-106071 (CVSS 3.6) — A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildca…
    CVE-2026-105483 (CVSS 7.4) — A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenti…
    CVE-2026-106070 (CVSS 3.7) — A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entr…
    CVE-2026-106073 (CVSS 3.3) — A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read…
    CVE-2026-111497 (CVSS 9.2) — A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through…
    CVE-2026-48932 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High