# CVE-2026-105483: Node.js TLS certificate hostname verification bypass with fullwidth digits

Source: https://junglewise.ai/threats/cve-2026-105483-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-105483 · Severity: high · CVSS 7.4 · Published 2026-10-23

Node.js is a JavaScript runtime used to build server applications and services. A flaw in TLS certificate validation allows an attacker to present a certificate issued for a different IP address when the target address is represented with fullwidth Unicode digits—for example, `１２７.0.0.1` instead of `127.0.0.1`. This enables man-in-the-middle attacks to intercept connections that should fail certificate verification, compromising the confidentiality and integrity of encrypted communications.

Technologies: [OpenJS Foundation Node.js](https://junglewise.ai/threats/technologies/openjs-foundation-node-js). Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-105483 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105483 being exploited in the wild.

**How severe is CVE-2026-105483?** High severity, with a CVSS score of 7.4, published 23 October 2026.

**Which products and versions are affected?** OpenJS Foundation Node.js 26.x, 24.x.

**Is there a fix for CVE-2026-105483?** Yes: fixed in Node.js v26.12.1, v24.22.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105483 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105483?** Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Node.js v26.12.1, v24.22.1

## Technical details

The tls.checkServerIdentity() function fails to recognize IPv4 addresses written with non-ASCII fullwidth digits as IP addresses, and instead matches them against DNS names and Common Name fields in the certificate. An attacker can obtain a certificate with a matching DNS SAN (such as DNS:127.0.0.1 or DNS:*.0.0.1) and use it to authenticate a connection when the client connects to a fullwidth-encoded variant of that IP. This is a regression introduced after CVE-2026-48618.

## Affected products

- OpenJS Foundation Node.js 26.x, 24.x

## Timeline

- 2026-10-21: disclosed
- 2026-10-23: advisory

## References

- [https://nodejs.org/en/blog/vulnerability/october-2026-security-releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)

## Related threats

- [Node.js TLS server use-after-destroy in deferred handshake callbacks](https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server)
- [Node.js https.Agent certificate validation bypass via TLS session reuse](https://junglewise.ai/threats/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a)
- [Node.js HTTP/2 denial of service via NULL pointer dereference](https://junglewise.ai/threats/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an)
- [Node.js HTTP/2 use-after-free in respondWithFile stream reset](https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated)
- [Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a)