CVE-2026-106069: Node.js TLS certificate hostname bypass when the host loosely resolves to an IP address

When Node.js opens a TLS connection, tls.checkServerIdentity() compares the host you asked for with the names and IP addresses in the server certificate. Hosts can be written in many numeric forms that operating systems still accept: shortened IPv4 such as 127.1, hexadecimal or octal parts, or a single decimal number. Before this fix, Node.js normalized such a host with domainToASCII() and matched the normalized form, but the platform resolver could read the original string as a different address. The check and the connection disagreed about where the client was going.

The practical precondition is that an attacker can choose or influence the host string your client connects to, and can present a certificate that matches the form Node.js checked. That is most realistic in internal networks, private PKI and mutual TLS, in SSRF-style features that connect to user-supplied addresses, and in clients that talk to IP-addressed services such as local model servers or service mesh endpoints. The result is a man-in-the-middle position on a connection the code believes is verified. The fix in lib/tls.js rejects hosts that only become IP addresses after normalization, so ambiguous forms fail instead of passing.

Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. The same commit also fixes a related medium-severity advisory about DNS SANs authenticating IP endpoints. Code at risk uses tls.connect(), https.request(), fetch() or any library on top of them with a host taken from input or configuration.

node -v
npx --yes envinfo --binaries 2>/dev/null | grep -i node
docker run --rm <your-image> node -v

Search for TLS clients that connect to hosts users can set, and for custom checkServerIdentity callbacks that call the default one.

Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1. After upgrading, connections to non-canonical numeric hosts fail instead of being checked loosely; fix any configuration that relied on forms like 127.1 by writing the address in canonical dotted form.

Until you upgrade, normalize and validate hosts yourself before connecting: parse with new URL(), reject numeric hosts that are not canonical IPv4 or IPv6, and connect to the canonical value.

Review configuration and logs for TLS connections to hosts written in hex (0x), octal (leading zeros), shortened or single-number IPv4 forms. Certificate errors that start appearing after the upgrade point to callers that used such forms; check whether any of them came from user input. In internal PKI, look for certificates whose DNS names are numeric strings, which have no legitimate use.

Node.js TLS identity checks normalized non-canonical numeric hosts before matching them against the certificate, while platform resolvers could interpret the original host as a different address. The fix rejects hosts that become IP addresses only after domainToASCII() normalization. Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, released October 21, 2026.