CVE-2026-106069 A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the c
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-106069?
CVE-2026-106069 is a high-severity vulnerability in nodejs node, published on 23 Oct 2026.
Official description
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.
`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Weakness: CWE-295
Which versions are affected by CVE-2026-106069?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 22.23.4, 24.22.1, 26.12.1 |
node-min Bitnami | All versions | 22.23.4, 24.22.1, 26.12.1 |
How do I fix CVE-2026-106069?
Upgrade node to a fixed version for your release line: 22.23.4, 24.22.1 or 26.12.1.
Is CVE-2026-106069 being exploited?
There is no known exploitation of CVE-2026-106069 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2026-106069, AZL-111047, BIT-node-2026-106069, BIT-node-min-2026-106069, DEBIAN-CVE-2026-106069, GHSA-jj44-m59q-wmrj and 1 more.