{
  "cve": [
    "CVE-2026-106069"
  ],
  "vulnerable": "22.x || 24.x || 26.x",
  "patched": "^22.23.4 || ^24.22.1 || ^26.12.1",
  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
  "description": "TLS certificate hostname bypass when the host loosely resolves to an IP address",
  "overview": "A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.\n\n`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
  "affectedEnvironments": [
    "all"
  ],
  "severity": "high"
}