CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity() normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (0127.0.0.1 becomes 87.0.0.1), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (127.0.0.1). A server at the connected address can then be authenticated with a certificate issued for another IP address. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Other sources
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1.
tls.checkServerIdentity() normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (0127.0.0.1 becomes 87.0.0.1), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (127.0.0.1). A server at the connected address can then be authenticated with a certificate issued for another IP address.
— Node.Js
A flaw was found in Node.js. Non-canonical numeric hostnames (for example 127.1 or 0127.0.0.1) can be normalized by domainToASCII() to one IPv4 address for certificate checks while the platform resolver connects to a different address. A TLS client may therefore accept a certificate that does not identify the connected peer, enabling server impersonation.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.22.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.12.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.4Fixed in 24.22.1Fixed in 26.12.1 - Upgrade
Upgrade
azurelinux/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1-0 - Upgrade
Upgrade
bitnami/nodeto a version that resolves this vulnerability.Fixed in 22.23.4 - Upgrade
Upgrade
bitnami/nodeto a version that resolves this vulnerability.Fixed in 24.22.1 - Upgrade
Upgrade
bitnami/nodeto a version that resolves this vulnerability.Fixed in 26.12.1 - Upgrade
Upgrade
bitnami/node-minto a version that resolves this vulnerability.Fixed in 22.23.4 - Upgrade
Upgrade
bitnami/node-minto a version that resolves this vulnerability.Fixed in 24.22.1 - Upgrade
Upgrade
bitnami/node-minto a version that resolves this vulnerability.Fixed in 26.12.1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 24.22.2+dfsg+~cs24.19.2-1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.4-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.12.1-r0 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1+dfsg+~cs24.19.2-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
How is this issue rated?
It is rated high severity (7) with a risk score of 36.
Which Node.js release information is referenced for this issue?
The provided references include the October 2026 Node.js security releases notice and the release notes for Node.js v22.23.4 and v24.22.1.