Description
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1. tls.checkServerIdentity() did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing DNS:127.0.0.1 and no IP Address:127.0.0.1 SAN was therefore accepted, while the same certificate is correctly rejected for 127.0.0.1. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 13 | | =20.19.2+dfsg-1 || =20.19.2+dfsg-1+deb13u1 || =20.19.2+dfsg-1+deb13u2 || =20.19.2+dfsg-1+deb13u3 || =20.19.4+dfsg-1 || =20.19.5+dfsg+~cs20.19.12-1 || =20.19.5+dfsg+~cs20.19.12-2 || =20.19.5+dfsg+~cs20.19.12-3 || =20.19.5+dfsg+~cs20.19.12-4 || =20.19.5+dfsg+~cs20.19.24-1 || =22.12.0+dfsg-1 || =22.12.0+dfsg-2 || =22.12.0+dfsg-3 || =22.14.0+dfsg-1 || =22.18.0+dfsg+~cs22.17.2-1 || =22.18.0+dfsg+~cs22.17.2-2 || =22.18.0+dfsg-1 || =22.19.0+dfsg+~cs22.18.0-1 || =22.21.1+dfsg+~cs22.19.0-1 || =22.21.1+dfsg+~cs22.19.0-2 || =22.21.1+dfsg+~cs22.19.0-3 || =22.21.1+dfsg+~cs22.19.0-4 || =22.21.1+dfsg+~cs22.19.0-5 || =22.21.1+dfsg+~cs22.19.0-6 || =22.22.0+dfsg+~cs22.19.13-1 || =22.22.0+dfsg+~cs22.19.13-2 || =22.22.0+dfsg+~cs22.19.6-1 || =22.22.1+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-3 || =24.11.1+dfsg+~cs24.10.1-1 || =24.11.1+dfsg+~cs24.10.1-2 || =24.12.0+dfsg+~cs24.10.4-1 || =24.13.0+dfsg+~cs24.10.7-1 || =24.13.0+dfsg+~cs24.10.7-2 || =24.14.0+dfsg+~cs24.12.0-1 || =24.14.0+dfsg+~cs24.12.0-2 || =24.14.1+dfsg+~cs24.12.0-1 || =24.15.0+dfsg+~cs24.12.2-1 || =24.16.0+dfsg+~cs24.13.1-1 || =24.16.0+dfsg+~cs24.13.1-2 || =24.17.0+dfsg+~cs24.13.2-1 || =24.18.0+dfsg+~cs24.13.2-1 || =24.19.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-2 || =24.21.0+dfsg+~cs24.13.4-1 || =24.22.0+dfsg+~cs24.19.2-1 || =24.22.0+dfsg+~cs24.19.2-2 | - |
debian 14 | | =20.19.2+dfsg-1 || =20.19.4+dfsg-1 || =20.19.5+dfsg+~cs20.19.12-1 || =20.19.5+dfsg+~cs20.19.12-2 || =20.19.5+dfsg+~cs20.19.12-3 || =20.19.5+dfsg+~cs20.19.12-4 || =20.19.5+dfsg+~cs20.19.24-1 || =22.12.0+dfsg-1 || =22.12.0+dfsg-2 || =22.12.0+dfsg-3 || =22.14.0+dfsg-1 || =22.18.0+dfsg+~cs22.17.2-1 || =22.18.0+dfsg+~cs22.17.2-2 || =22.18.0+dfsg-1 || =22.19.0+dfsg+~cs22.18.0-1 || =22.21.1+dfsg+~cs22.19.0-1 || =22.21.1+dfsg+~cs22.19.0-2 || =22.21.1+dfsg+~cs22.19.0-3 || =22.21.1+dfsg+~cs22.19.0-4 || =22.21.1+dfsg+~cs22.19.0-5 || =22.21.1+dfsg+~cs22.19.0-6 || =22.22.0+dfsg+~cs22.19.13-1 || =22.22.0+dfsg+~cs22.19.13-2 || =22.22.0+dfsg+~cs22.19.6-1 || =22.22.1+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-3 || =24.11.1+dfsg+~cs24.10.1-1 || =24.11.1+dfsg+~cs24.10.1-2 || =24.12.0+dfsg+~cs24.10.4-1 || =24.13.0+dfsg+~cs24.10.7-1 || =24.13.0+dfsg+~cs24.10.7-2 || =24.14.0+dfsg+~cs24.12.0-1 || =24.14.0+dfsg+~cs24.12.0-2 || =24.14.1+dfsg+~cs24.12.0-1 || =24.15.0+dfsg+~cs24.12.2-1 || =24.16.0+dfsg+~cs24.13.1-1 || =24.16.0+dfsg+~cs24.13.1-2 || =24.17.0+dfsg+~cs24.13.2-1 || =24.18.0+dfsg+~cs24.13.2-1 || =24.19.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-2 || =24.21.0+dfsg+~cs24.13.4-1 || =24.22.0+dfsg+~cs24.19.2-1 || =24.22.0+dfsg+~cs24.19.2-2 | - |
debian 12 | | =18.13.0+dfsg1-1 || =18.13.0+dfsg1-1.1 || =18.19.0+dfsg-1 || =18.19.0+dfsg-2 || =18.19.0+dfsg-3 || =18.19.0+dfsg-4 || =18.19.0+dfsg-5 || =18.19.0+dfsg-6 || =18.19.0+dfsg-6~deb12u1 || =18.19.0+dfsg-6~deb12u2 || =18.19.1+dfsg-1 || =18.19.1+dfsg-2 || =18.19.1+dfsg-3 || =18.19.1+dfsg-3.1 || =18.19.1+dfsg-4 || =18.19.1+dfsg-6 || =18.20.1+dfsg-1 || =18.20.1+dfsg-2 || =18.20.1+dfsg-3 || =18.20.1+dfsg-4 || =18.20.4+dfsg-1~deb12u1 || =18.20.4+dfsg-1~deb12u2 || =18.20.4+dfsg-1~deb12u3 || =20.10.0+dfsg-1 || =20.12.2+dfsg-1 || =20.13.0+dfsg-1 || =20.13.1+dfsg-1 || =20.13.1+dfsg-2 || =20.14.0+dfsg-1 || =20.14.0+dfsg-2 || =20.14.0+dfsg-3 || =20.15.0+dfsg-1 || =20.15.1+dfsg-1 || =20.16.0+dfsg-1 || =20.17.0+dfsg-1 || =20.17.0+dfsg-2 || =20.18.0+dfsg-1 || =20.18.0+dfsg-2 || =20.18.1+dfsg-1 || =20.18.1+dfsg-2 || =20.18.2+dfsg-1 || =20.18.2+dfsg-2 || =20.18.2+dfsg-3 || =20.18.2+dfsg-4 || =20.18.3+dfsg-1 || =20.19.0+dfsg-1 || =20.19.0+dfsg-2 || =20.19.0+dfsg1-1 || =20.19.2+dfsg-1 || =20.19.4+dfsg-1 || =20.19.5+dfsg+~cs20.19.12-1 || =20.19.5+dfsg+~cs20.19.12-2 || =20.19.5+dfsg+~cs20.19.12-3 || =20.19.5+dfsg+~cs20.19.12-4 || =20.19.5+dfsg+~cs20.19.24-1 || =22.12.0+dfsg-1 || =22.12.0+dfsg-2 || =22.12.0+dfsg-3 || =22.14.0+dfsg-1 || =22.18.0+dfsg+~cs22.17.2-1 || =22.18.0+dfsg+~cs22.17.2-2 || =22.18.0+dfsg-1 || =22.19.0+dfsg+~cs22.18.0-1 || =22.21.1+dfsg+~cs22.19.0-1 || =22.21.1+dfsg+~cs22.19.0-2 || =22.21.1+dfsg+~cs22.19.0-3 || =22.21.1+dfsg+~cs22.19.0-4 || =22.21.1+dfsg+~cs22.19.0-5 || =22.21.1+dfsg+~cs22.19.0-6 || =22.22.0+dfsg+~cs22.19.13-1 || =22.22.0+dfsg+~cs22.19.13-2 || =22.22.0+dfsg+~cs22.19.6-1 || =22.22.1+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-3 || =24.11.1+dfsg+~cs24.10.1-1 || =24.11.1+dfsg+~cs24.10.1-2 || =24.12.0+dfsg+~cs24.10.4-1 || =24.13.0+dfsg+~cs24.10.7-1 || =24.13.0+dfsg+~cs24.10.7-2 || =24.14.0+dfsg+~cs24.12.0-1 || =24.14.0+dfsg+~cs24.12.0-2 || =24.14.1+dfsg+~cs24.12.0-1 || =24.15.0+dfsg+~cs24.12.2-1 || =24.16.0+dfsg+~cs24.13.1-1 || =24.16.0+dfsg+~cs24.13.1-2 || =24.17.0+dfsg+~cs24.13.2-1 || =24.18.0+dfsg+~cs24.13.2-1 || =24.19.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-1 || =24.20.0+dfsg+~cs24.13.3-2 || =24.21.0+dfsg+~cs24.13.4-1 || =24.22.0+dfsg+~cs24.19.2-1 || =24.22.0+dfsg+~cs24.19.2-2 | - |
 alpine v3.21 | | | 22.23.4-r0 |
alpine v3.22 | | | 22.23.4-r0 |
alpine v3.23 | | | 24.22.1-r0 |
alpine v3.24 | | | 24.22.1-r0 |
 rpm rhel8 | | - | - |
rpm rhel9 | | - | - |
rpm rhel10 | | - | - |
