BIT-node-2026-106069

    Dashboard / Vulnerabilities / BIT-node-2026-106069

    BIT-node-2026-106069

    Published: 29 Oct 2026Last Modified: 29 Oct 2026

    Summary:

    Details: A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

    References: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases, https://nvd.nist.gov/vuln/detail/CVE-2026-106069

    Affected packages

    Package

    Name: node

    Purl: pkg:bitnami/node

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -22.23.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-node-2026-106069 | CVE-DB