Is CVE-2026-106069 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106069 being exploited in the wild.

How severe is CVE-2026-106069?

High severity, with a CVSS score of 7.4, published 23 October 2026.

Which products and versions are affected?

OpenJS Foundation Node.js 26.x, 24.x, 22.x.

Is there a fix for CVE-2026-106069?

Yes: fixed in Node.js 26.12.1, 24.22.1, 22.23.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106069 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106069?

Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106069: Node.js TLS hostname verification bypass with non-canonical IPv4

CVE-2026-106069 · Severity: high · CVSS 7.4 · Published 2026-10-23

Node.js uses TLS to secure connections to remote servers. When a client connects to a server using a non-standard IPv4 address format (with leading zeros, like 0127.0.0.1), Node.js interprets it differently than the operating system does, causing the certificate validation to check against the wrong IP address. An attacker controlling a server at a different IP can present a valid certificate for that other address to establish a trusted connection, enabling man-in-the-middle attacks or credential theft.

Technologies: OpenJS Foundation Node.js. Vendors: OpenJS Foundation.

Quick answers

Is CVE-2026-106069 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106069 being exploited in the wild.
How severe is CVE-2026-106069?: High severity, with a CVSS score of 7.4, published 23 October 2026.
Which products and versions are affected?: OpenJS Foundation Node.js 26.x, 24.x, 22.x.
Is there a fix for CVE-2026-106069?: Yes: fixed in Node.js 26.12.1, 24.22.1, 22.23.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106069 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106069?: Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Node.js 26.12.1, 24.22.1, 22.23.4

Technical details

The vulnerability exists in tls.checkServerIdentity(), which normalizes hostnames following WHATWG URL rules that interpret leading-zero octets as octal notation (0127.0.0.1 → 87.0.0.1), while the OS resolver on platforms like macOS treats them as decimal (127.0.0.1). This mismatch allows a certificate issued for one IP to validate the connection to a different IP address. The attack requires the client to connect using a non-canonical IPv4 literal with a leading zero.

Affected products

OpenJS Foundation Node.js 26.x, 24.x, 22.x

Timeline

2026-10-21: disclosed
2026-10-23: advisory

References

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.