CVE-2026-105483
TLS hostname check bypass in Node.js lets attacker use wrong certificate for IPv4 addresses.
Node.js fails to treat hostnames containing non-ASCII characters, such as fullwidth digits, as IP addresses during TLS certificate verification. A certificate without a matching IP address SAN can therefore be accepted for an IPv4 endpoint if it contains a DNS name like 127.0.0.1 or *.0.0.1. Versions 26.x and 24.x are affected, no fixed version is listed, and CISA has not listed this CVE as known exploited.
nodejs node · Updated 28 Oct · From the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeverityhighCVSS 7.4 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- No fixed version is listed in the available records, so treat Node.js 26.x and 24.x TLS connections as vulnerable.
- Until a fix exists, avoid using non-ASCII hostname forms such as fullwidth digits for TLS endpoints.
- Watch the Cisco and Fortinet advisories from October 2026 for updated guidance.
What happened
- 26 OctFortinet publishes an advisory listing multiple Node.js CVEs, including this one.
- 27 OctCisco publishes an advisory on Node.js vulnerabilities affecting Cisco products.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-105483 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host… | high 7.4 | No | 0.3% |
Our reporting
We have not reported on it. It is here because the sources below did.
Reported elsewhere
Cisco · 27 OctVulnerabilities in node.js Affecting Cisco Products: October 2026 ↗Fortinet · 26 OctMultiple Node.js CVEs ↗The records
CVE-2026-105483 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works