Improper validation of certificate with host mismatch in Node.js - CVE-2026-106069

Vulnerability details

The vulnerability allows a remote attacker to authenticate a TLS server using a certificate issued for a different IP address.

The vulnerability exists due to inconsistent IP address interpretation in Node.js tls.checkServerIdentity() and the operating system resolver when connecting to a non-canonical IPv4 literal with a leading zero. A remote attacker can serve a certificate for 87.0.0.1 at the connected address 127.0.0.1 when the client uses 0127.0.0.1, exploiting octal interpretation during certificate validation and decimal interpretation during connection establishment to bypass endpoint identity verification.

Exploitation depends on resolver behavior that interprets the leading-zero octet as decimal, as described for platforms such as macOS.

Affected software

How to mitigate CVE-2026-106069

External References

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Related Security Bulletins

• Multiple vulnerabilities in Node.js
• Anolis OS update for nodejs