BIT-node-min-2026-105483: High severity bitnami/node vulnerability

Q: Which deployments are exposed?

The affected Node.js release lines are 26.x and 24.x. The listed affected software includes bitnami/node and bitnami/node-min, and exposure requires TLS connections to IPv4 endpoints using a hostname representation containing non-ASCII characters.

Q: What does an attacker need to exploit this?

The attack is network-based and requires no privileges or user interaction, but has high attack complexity. The attacker must be able to present a certificate with a DNS name such as 127.0.0.1 or *.0.0.1 while the client connects using a non-ASCII representation that normalizes to an IPv4 address.

Published Oct 29, 2026

Updated

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (１２７.0.0.1).

tls.checkServerIdentity() did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing DNS:127.0.0.1 or DNS:.0.0.1 could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.

This vulnerability affects Node.js 26.x and 24.x.

Affected Software

4 affected componentsFixes available

bitnami/node>=23.0.0<24.22.1

24.22.1

bitnami/node>=25.0.0<26.12.1

26.12.1

bitnami/node-min>=23.0.0<24.22.1

24.22.1

bitnami/node-min>=25.0.0<26.12.1

26.12.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 24.22.1
Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 26.12.1
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 24.22.1
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 26.12.1

Event History

Oct 29, 2026

Advisory Published

via OSV·08:55 AM

Data Sourced

via OSV·08:55 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

The affected Node.js release lines are 26.x and 24.x. The listed affected software includes bitnami/node and bitnami/node-min, and exposure requires TLS connections to IPv4 endpoints using a hostname representation containing non-ASCII characters.

What does an attacker need to exploit this?

The attack is network-based and requires no privileges or user interaction, but has high attack complexity. The attacker must be able to present a certificate with a DNS name such as 127.0.0.1 or *.0.0.1 while the client connects using a non-ASCII representation that normalizes to an IPv4 address.

BIT-node-min-2026-105483: High severity bitnami/node vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?