A TLS Hostname verification bypass vulnerability exists in NodeJS. This flaw allows an attacker to bypass TLS Hostname verification when a TLS client reuses HTTPS sessions.
A flaw was found in nodejs. Calling napigetvaluestringlatin1(), napigetvaluestringutf8(), or napigetvaluestringutf16() with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf, probably overrunning the length of the buffer.