CVE-2026-106072 A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects

What is CVE-2026-106072?

CVE-2026-106072 is a medium-severity vulnerability in nodejs node, published on 23 Oct 2026.

Official description

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.

`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Weakness: CWE-295

Which versions are affected by CVE-2026-106072?

2 open source packages ship an affected version, including node and node-min.

How do I fix CVE-2026-106072?

Upgrade node to a fixed version for your release line: 22.23.4, 24.22.1 or 26.12.1.

Is CVE-2026-106072 being exploited?

There is no known exploitation of CVE-2026-106072 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-106072, AZL-111053, BIT-node-2026-106072, BIT-node-min-2026-106072, DEBIAN-CVE-2026-106072, GHSA-pghh-9966-75r7 and 1 more.