AZL-111047: CVE-2026-106069 affecting package nodejs for versions less than 24.22.1-0

Q: Which deployments are realistically exposed to this issue?

Deployments using affected Node.js 22.x, 24.x, or 26.x are exposed when they make TLS connections to hosts expressed as non-canonical IPv4 literals with leading-zero octets. Exposure depends on platforms whose operating-system resolver interprets those octets differently from WHATWG URL normalization; macOS is identified as an example.

Q: What must an attacker control or induce to exploit the certificate-validation mismatch?

An attacker would need the client to connect using a leading-zero IPv4 literal that resolves at the operating-system level to one address while Node.js normalizes it to another address for TLS hostname verification. The server at the address actually reached could then present a certificate valid for the differently normalized IP address.

Q: Are ordinary canonical IPv4 addresses affected?

The described condition specifically requires a non-canonical IPv4 literal with a leading zero in an octet, such as 0127.0.0.1. The data does not indicate that canonical IPv4 literals are affected.

Q: What version should be deployed to remediate the Azure Linux nodejs package?

Update the azure-linux/nodejs package to version 24.22.1-0 or later. The vulnerability record states that versions less than 24.22.1-0 are affected.

Published Oct 23, 2026

Updated

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1.

tls.checkServerIdentity() normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (0127.0.0.1 becomes 87.0.0.1), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (127.0.0.1). A server at the connected address can then be authenticated with a certificate issued for another IP address.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Affected Software

1 affected componentFixes available

azure-linux/nodejs<24.22.1-0

24.22.1-0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade azure-linux/nodejs to a version that resolves this vulnerability.
Fixed in 24.22.1-0
Upgrade
Upgrade nodejs to a version that resolves this vulnerability.
Fixed in 24.22.1-0

Event History

Oct 23, 2026

Advisory Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-106069

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

Deployments using affected Node.js 22.x, 24.x, or 26.x are exposed when they make TLS connections to hosts expressed as non-canonical IPv4 literals with leading-zero octets. Exposure depends on platforms whose operating-system resolver interprets those octets differently from WHATWG URL normalization; macOS is identified as an example.

What must an attacker control or induce to exploit the certificate-validation mismatch?

An attacker would need the client to connect using a leading-zero IPv4 literal that resolves at the operating-system level to one address while Node.js normalizes it to another address for TLS hostname verification. The server at the address actually reached could then present a certificate valid for the differently normalized IP address.

Are ordinary canonical IPv4 addresses affected?

The described condition specifically requires a non-canonical IPv4 literal with a leading zero in an octet, such as 0127.0.0.1. The data does not indicate that canonical IPv4 literals are affected.

What version should be deployed to remediate the Azure Linux nodejs package?

Update the azure-linux/nodejs package to version 24.22.1-0 or later. The vulnerability record states that versions less than 24.22.1-0 are affected.

AZL-111047: CVE-2026-106069 affecting package nodejs for versions less than 24.22.1-0

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What must an attacker control or induce to exploit the certificate-validation mismatch?

Are ordinary canonical IPv4 addresses affected?

What version should be deployed to remediate the Azure Linux nodejs package?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What must an attacker control or induce to exploit the certificate-validation mismatch?

Are ordinary canonical IPv4 addresses affected?

What version should be deployed to remediate the Azure Linux nodejs package?