BIT-node-2026-105483: High severity bitnami/node vulnerability

Q: Which Node.js deployments are affected?

The issue affects Node.js 26.x and 24.x, including the listed bitnami/node and bitnami/node-min software. It applies to TLS connections where hostname verification is performed against an IPv4 endpoint represented using non-ASCII characters.

Q: What does an attacker need to exploit this issue?

An attacker needs to present a certificate with a DNS name such as 127.0.0.1 or *.0.0.1 while the client connects to an IPv4 address written with non-ASCII characters, for example fullwidth digits. The malformed host representation normalizes and resolves as IPv4 but is checked as a DNS hostname instead of an IP address.

Q: Are ordinary ASCII IPv4 connection strings affected?

The described bypass depends on the IPv4 host being written with non-ASCII characters. The provided information does not indicate that normal ASCII IPv4 address notation is affected.

Published Oct 29, 2026

Updated

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (１２７.0.0.1).

tls.checkServerIdentity() did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing DNS:127.0.0.1 or DNS:.0.0.1 could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.

This vulnerability affects Node.js 26.x and 24.x.

Affected Software

4 affected componentsFixes available

bitnami/node>=23.0.0<24.22.1

24.22.1

bitnami/node>=25.0.0<26.12.1

26.12.1

bitnami/node-min>=23.0.0<24.22.1

24.22.1

bitnami/node-min>=25.0.0<26.12.1

26.12.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 24.22.1
Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 26.12.1
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 24.22.1
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 26.12.1

Event History

Oct 29, 2026

Advisory Published

via OSV·08:55 AM

Data Sourced

via OSV·08:55 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Node.js deployments are affected?

The issue affects Node.js 26.x and 24.x, including the listed bitnami/node and bitnami/node-min software. It applies to TLS connections where hostname verification is performed against an IPv4 endpoint represented using non-ASCII characters.

What does an attacker need to exploit this issue?

An attacker needs to present a certificate with a DNS name such as 127.0.0.1 or *.0.0.1 while the client connects to an IPv4 address written with non-ASCII characters, for example fullwidth digits. The malformed host representation normalizes and resolves as IPv4 but is checked as a DNS hostname instead of an IP address.

Are ordinary ASCII IPv4 connection strings affected?

The described bypass depends on the IPv4 host being written with non-ASCII characters. The provided information does not indicate that normal ASCII IPv4 address notation is affected.

BIT-node-2026-105483: High severity bitnami/node vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Node.js deployments are affected?

What does an attacker need to exploit this issue?

Are ordinary ASCII IPv4 connection strings affected?

Company

Resources

Contact

Frequently Asked Questions

Which Node.js deployments are affected?

What does an attacker need to exploit this issue?

Are ordinary ASCII IPv4 connection strings affected?