Description
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (１２７.0.0.1).
tls.checkServerIdentity() did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing DNS:127.0.0.1 or DNS:*.0.0.1 could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.
This vulnerability affects Node.js 26.x and 24.x.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 14 | | =20.19.2+dfsg-1 || =20.19.4+dfsg-1 || =20.19.5+dfsg+~cs20.19.12-1 || =20.19.5+dfsg+~cs20.19.12-2 || =20.19.5+dfsg+~cs20.19.12-3 || =20.19.5+dfsg+~cs20.19.12-4 || =20.19.5+dfsg+~cs20.19.24-1 || =22.12.0+dfsg-1 || =22.12.0+dfsg-2 || =22.12.0+dfsg-3 || =22.14.0+dfsg-1 || =22.18.0+dfsg+~cs22.17.2-1 || =22.18.0+dfsg+~cs22.17.2-2 || =22.18.0+dfsg-1 || =22.19.0+dfsg+~cs22.18.0-1 || =22.21.1+dfsg+~cs22.19.0-1 || =22.21.1+dfsg+~cs22.19.0-2 || =22.21.1+dfsg+~cs22.19.0-3 || =22.21.1+dfsg+~cs22.19.0-4 || =22.21.1+dfsg+~cs22.19.0-5 || =22.21.1+dfsg+~cs22.19.0-6 || =22.22.0+dfsg+~cs22.19.13-1 || =22.22.0+dfsg+~cs22.19.13-2 || =22.22.0+dfsg+~cs22.19.6-1 || =22.22.1+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-3 || =24.11.1+dfsg+~cs24.10.1-1 || =24.11.1+dfsg+~cs24.10.1-2 || =24.12.0+dfsg+~cs24.10.4-1 || =24.13.0+dfsg+~cs24.10.7-1 || =24.13.0+dfsg+~cs24.10.7-2 || =24.14.0+dfsg+~cs24.12.0-1 || =24.14.0+dfsg+~cs24.12.0-2 || =24.14.1+dfsg+~cs24.12.0-1 || =24.15.0+dfsg+~cs24.12.2-1 || =24.16.0+dfsg+~cs24.13.1-1 || =24.16.0+dfsg+~cs24.13.1-2 || =24.17.0+dfsg+~cs24.13.2-1 || =24.18.0+dfsg+~cs24.13.2-1 || =24.19.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-2 || =24.21.0+dfsg+~cs24.13.4-1 || =24.22.0+dfsg+~cs24.19.2-1 || =24.22.0+dfsg+~cs24.19.2-2 | - |
 alpine v3.23 | | | 24.22.1-r0 |
alpine v3.24 | | | 24.22.1-r0 |
 rpm rhel8 | | - | - |
rpm rhel9 | | - | - |
rpm rhel10 | | - | - |
rpm rhel10 | | - | - |
