CVE-2026-106072: Node.js improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints

X.509 certificates list DNS names and IP addresses in separate subject alternative name (SAN) types, and the rules say an IP endpoint must match an IP address entry. Node.js decides which rule to apply by asking whether the host is an IP address. A non-canonical form such as a shortened or hexadecimal IPv4 string did not look like an IP address at that point, so Node.js fell back to matching DNS names, even though the operating system still connected to the numeric address.

An attacker who can hold a certificate with a DNS SAN equal to that odd string, and who can steer a client to connect to it, gets a verified-looking TLS session to an IP endpoint the certificate never covered. Public CAs do not issue such names, so the realistic setting is private PKI, internal CAs, development certificates trusted in a fleet, or mutual TLS between services. The test fixture added with the fix is exactly such a certificate. The same commit fixes a closely related High-severity hostname bypass; both are closed by rejecting hosts that only turn into IP addresses after domainToASCII() normalization.

Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. Exposure needs two things: a TLS client connecting to a host string an attacker can influence, and a trust store that accepts certificates from a CA the attacker can use, such as an internal CA.

node -v
npx --yes envinfo --binaries 2>/dev/null | grep -i node
docker run --rm <your-image> node -v

List the custom CA bundles your services load (NODE_EXTRA_CA_CERTS, the ca option) to see where internal PKI is trusted.

Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1. After the upgrade, numeric hosts in non-canonical form are rejected, so write IP endpoints in canonical form in configuration.

As a hardening step, make sure internal CAs never issue certificates whose DNS names are numeric strings, and limit which services trust each internal CA.

Audit your internal CA's issued certificates for DNS SANs that are numbers or IP-like strings; any such certificate is suspicious. In client logs, look for TLS connections to hosts written as 0x values, with leading zeros or as shortened IPv4, and check who supplied them.

When a Node.js TLS client connected to an IPv4 address written in a non-canonical form, the certificate check could match it against DNS subject alternative names instead of IP address entries, so a certificate with a matching DNS name could authenticate an IP endpoint. The fix rejects hosts that become IP addresses only after normalization. Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, released October 21, 2026.