CVE-2026-106072

A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling (for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1), tls.checkServerIdentity() may fail to classify the host as an IP address, normalize it to a canonical form, and match that form against certificate DNS SANs instead of requiring an IP Address SAN. A certificate that contains a DNS SAN equal to the canonical IP string (for example DNS:127.0.0.1) without a corresponding IP Address SAN can therefore be accepted for an IP endpoint. Exploitation requires a certificate with such a numeric DNS SAN that is trusted by the client, and a platform resolver that accepts the non-canonical spelling (glibc does).

This is a Moderate severity flaw, matching the upstream Node.js Medium rating. Red Hat aligns with the CNA CVSS (6.7): exploitation requires both a non-canonical IPv4 host form and a certificate with a DNS SAN for the canonical IP string that is already trusted by the client (Privileges Required: High relative to a generic network attacker without such a cert). On Red Hat platforms using glibc, the resolver accepts these spellings, so that part of the prerequisite is met. Successful abuse can confuse TLS endpoint identity with high confidentiality and integrity impact for the affected connection, but the trusted-cert barrier keeps the overall rating Moderate rather than Important.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input. Where feasible, pin expected server certificates or public keys for sensitive outbound TLS. Restrict which destinations Node.js workloads may reach with egress controls.