Improper validation of certificate with host mismatch in Node.js - CVE-2026-105483
Published: October 26, 2026
Vulnerability identifier: #VU157669
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105483
CWE-ID: CWE-297
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass TLS endpoint identity verification using a certificate without a matching IP address subject alternative name.
The vulnerability exists due to improper certificate hostname validation in Node.js tls.checkServerIdentity() when an IPv4 host is written with non-ASCII characters, such as １２７.0.0.1. A remote attacker can present a certificate containing DNS:127.0.0.1 or DNS:*.0.0.1 to have the endpoint accepted through DNS-name or Common Name matching instead of the required IP address verification.
Affected software
Node.js
Anolis OS
nodejs-npm
v8-13.6-devel
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-libs
nodejs-docs
Anolis OS
nodejs-npm
v8-13.6-devel
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-libs
nodejs-docs
How to mitigate CVE-2026-105483
Install security update from vendor's website.
Node.js - addressed in versions 22.23.4, 24.22.1, 26.12.1
nodejs-npm - update to 11.19.1-1.24.22.1.1
v8-13.6-devel - update to 13.6.233.17-1.24.22.1.1
nodejs - update to 24.22.1-1
nodejs-devel - update to 24.22.1-1
nodejs-full-i18n - update to 24.22.1-1
nodejs-libs - update to 24.22.1-1
nodejs-docs - update to 24.22.1-1
nodejs-npm - update to 11.19.1-1.24.22.1.1
v8-13.6-devel - update to 13.6.233.17-1.24.22.1.1
nodejs - update to 24.22.1-1
nodejs-devel - update to 24.22.1-1
nodejs-full-i18n - update to 24.22.1-1
nodejs-libs - update to 24.22.1-1
nodejs-docs - update to 24.22.1-1