{"id":"CVE-2026-106069","revision":"dd242302a9084303851b894f1e213cdd","records":[{"revision":"dd242302a9084303851b894f1e213cdd","observedAt":"2026-10-23T17:48:20.538+00:00","statement":{"source":"cve-program","id":"CVE-2026-106069","aliases":[],"title":"A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127…","description":"A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.\n\n`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","state":0,"publishedAt":"2026-10-23T16:15:05.85+00:00","modifiedAt":"2026-10-23T16:15:05.85+00:00","affected":[{"ecosystem":"Vendor product","name":"node","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"vendor\": \"nodejs\",\n                    \"product\": \"node\",\n                    \"versions\": [\n                        {\n                            \"version\": \"22.23.3\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"22.23.3\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"24.22.0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"24.22.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"26.12.0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"26.12.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4,"severity":"HIGH"}],"references":["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106069","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106069","identifiers":["CVE-2026-106069"]},"retained":false,"historicalAffected":[]}],"coverage":[]}