# CVE-2026-106072: Node.js TLS certificate hostname verification bypass with non-canonical IPv4

Source: https://junglewise.ai/threats/cve-2026-106072-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-106072 · Severity: medium · CVSS 6.7 · Published 2026-10-23

Node.js, a widely-used JavaScript runtime for building server applications, has a flaw in how it validates TLS certificates for IP address endpoints. An attacker with a certificate containing an IP address listed as a DNS name (rather than in the certificate's IP field) can use alternative spellings of localhost or other IP addresses (like octal 0177.0.0.1 or hexadecimal 0x7f.0.0.1) to bypass verification and perform man-in-the-middle attacks, even though the same certificate would be rejected for standard IP notation.

Technologies: [OpenJS Foundation Node.js](https://junglewise.ai/threats/technologies/openjs-foundation-node-js). Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-106072 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106072 being exploited in the wild.

**How severe is CVE-2026-106072?** Medium severity, with a CVSS score of 6.7, published 23 October 2026.

**Which products and versions are affected?** OpenJS Foundation Node.js 26.x, 24.x, 22.x.

**Is there a fix for CVE-2026-106072?** Yes: fixed in Node.js 26.12.1, 24.22.1, 22.23.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106072 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-106072?** Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Node.js 26.12.1, 24.22.1, 22.23.4

## Technical details

The vulnerability is a hostname verification bypass in tls.checkServerIdentity() where non-canonical IPv4 representations (octal, hexadecimal, decimal integer, or shortened forms) are not properly recognized as IP addresses and are instead matched against DNS SANs in the certificate. An attacker needs a certificate with a numeric DNS SAN (e.g., DNS:127.0.0.1) issued by a trusted CA, and the client must connect using an alternative IP spelling that the platform resolver (like glibc) accepts and normalizes to the IP address in the certificate's DNS field. The fix ensures these alternative spellings are correctly classified as IP addresses before validation.

## Affected products

- OpenJS Foundation Node.js 26.x, 24.x, 22.x

## Timeline

- 2026-10-21: disclosed
- 2026-10-23: advisory

## References

- [https://nodejs.org/en/blog/vulnerability/october-2026-security-releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)

## Related threats

- [Node.js TLS server use-after-destroy in deferred handshake callbacks](https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server)
- [Node.js https.Agent certificate validation bypass via TLS session reuse](https://junglewise.ai/threats/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a)
- [Node.js HTTP/2 denial of service via NULL pointer dereference](https://junglewise.ai/threats/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an)
- [Node.js HTTP/2 use-after-free in respondWithFile stream reset](https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated)
- [Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a)