CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits
Published Oct 21, 2026
·Updated
Affected Software
3 affected componentsFixes available
Node.js Node.js>=24.0.0<24.22.1, >=26.0.0<26.12.1
24.22.126.12.1
Node.js Node.js>=24.0.0<24.22.1
24.22.1
Node.js Node.js>=26.0.0<26.12.1
26.12.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.22.1Fixed in 26.12.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.22.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.12.1
Event History
Oct 21, 2026
CVE Published
via Node.js·10:39 AM
Data Sourced
via Node.js·10:39 AM
SeverityAffected Software
Data Sourced
via Node.js·10:00 PM
Description
Parent advisories
This vulnerability appears in the following advisories.