CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (１２７.0.0.1). tls.checkServerIdentity() did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing DNS:127.0.0.1 or DNS:.0.0.1 could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js 26.x and 24.x.
Other sources
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (１２７.0.0.1).
tls.checkServerIdentity() did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing DNS:127.0.0.1 or DNS:.0.0.1 could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.
— Node.Js
A flaw was found in Node.js. A regression in TLS IP hostname normalization allows a host written with fullwidth Unicode digits to bypass certificate hostname verification in checkServerIdentity. A TLS client can be made to accept a certificate that does not properly identify the requested IP address when connecting with such a hostname, enabling server impersonation.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.22.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.12.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.22.1Fixed in 26.12.1 - Upgrade
Upgrade
azurelinux/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1-0 - Upgrade
Upgrade
bitnami/nodeto a version that resolves this vulnerability.Fixed in 24.22.1 - Upgrade
Upgrade
bitnami/nodeto a version that resolves this vulnerability.Fixed in 26.12.1 - Upgrade
Upgrade
bitnami/node-minto a version that resolves this vulnerability.Fixed in 24.22.1 - Upgrade
Upgrade
bitnami/node-minto a version that resolves this vulnerability.Fixed in 26.12.1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.22.2+dfsg+~cs24.19.2-1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.12.1-r0 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1+dfsg+~cs24.19.2-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
Which Node.js release announcements are referenced for this issue?
The record references the Node.js v24.22.1 and v26.12.1 release announcements, along with the October 2026 Node.js security releases announcement.
When was this issue published and last modified?
It was published on 2026-10-21 and was last modified on 2026-10-21.