CVE-2026-106069
Bypass TLS hostname verification in Node.js via non-canonical IPv4 literal
A flaw in Node.js TLS hostname verification mishandles IPv4 addresses with leading zeros, reading them as octal (base 8) while the operating system resolver reads them as decimal (base 10). This can cause a server at the connected address to be authenticated with a certificate issued for a different IP address. The flaw affects Node.js 22.x, 24.x, and 26.x. No fix has been released yet.
nodejs node · Updated 28 Oct · From the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeverityhighCVSS 7.4 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- No fix has been released. No workaround is provided in the available records.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-106069 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, … | high 7.4 | No | 0.3% |
Our reporting
We have not reported on it. It is here because the sources below did.
Reported elsewhere
Cisco · 27 OctVulnerabilities in node.js Affecting Cisco Products: October 2026 ↗Fortinet · 26 OctMultiple Node.js CVEs ↗The records
CVE-2026-106069 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works