CVE-2026-105483: Node.js TLS certificate hostname bypass when the IP is written fullwidth digits

Unicode has fullwidth versions of the digits 0 to 9 (U+FF10 to U+FF19) and of the full stop. When a host name goes through IDNA processing, these become ordinary ASCII digits, so a string that looks like text can turn into an IPv4 address. A regression in how Node.js 24 and 26 normalized such hosts meant the TLS identity check did not treat the result the way the connection did, and the commit message says plainly that "the hostname check can be bypassed."

To use this, an attacker must control or influence the host string a Node.js client connects to, for example through a user-supplied URL, a webhook target or an agent tool that fetches links, and must be positioned to answer the connection with a certificate that would otherwise be rejected. Public websites reached by ordinary domain names are not the target; the risk sits with clients that connect to addresses taken from input. The fix, titled "tls: fix ip normalization regression," restores consistent normalization so the identity check sees the real address.

Affected: Node.js 24.x before 24.22.1 and 26.x before 26.12.1. The 22.x line is not affected by this advisory. Check which line each service runs:

node -v
npx --yes envinfo --binaries 2>/dev/null | grep -i node
docker run --rm <your-image> node -v

Code at risk passes host names from users or external data to https.request(), tls.connect() or fetch().

Upgrade to Node.js 24.22.1 or 26.12.1 and restart the services. Node.js 22 users do not need a fix for this specific bug but should still install 22.23.4 for the other advisories in the same release.

Until you upgrade, parse user-supplied URLs with new URL() and reject hosts that contain non-ASCII digits or that resolve to IP literals, before any connection is made.

Search inputs and logs for host names that contain fullwidth characters (code points U+FF10 to U+FF19 or the fullwidth full stop U+FF0E), or for IDNA-encoded hosts that decode to digits. A user-supplied URL that looks like text but connects to an IP address is the pattern to look for.

A regression in Node.js IP normalization let a host written with fullwidth Unicode digits bypass the TLS certificate hostname check. The fix corrects the IP normalization so the hostname check is applied as intended. Affected: Node.js 24.x before 24.22.1 and 26.x before 26.12.1. Fixed in Node.js 24.22.1 and 26.12.1, released October 21, 2026.