CVE-2026-106069
Reported by hackerone · Published October 23, 2026
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| nodejs | errata.rockylinux.org | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.src, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.src, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64 |
| nodejs-docs | errata.rockylinux.org | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.noarch, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.noarch |
| nodejs-libs | errata.rockylinux.org | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64 |
| nodejs-packaging-bundler | errata.rockylinux.org | 0:2021.06-6.module+el9.8.0+40164+8921ab53.noarch, 0:2021.06-6.module+el9.7.0+40165+d075e3f2.noarch, 0:2021.06-6.module+el9.7.0+40153+4d595597.noarch, 0:2021.06-6.module+el9.7.0+40052+e32ea525.noarch, 0:2021.06-6.module+el8.10.0+40172+38f6fdd1.noarch, 0:2021.06-6.module+el8.10.0+40171+8fa9c325.noarch, 0:2021.06-6.module+el8.10.0+40048+6d99f608.noarch |
| nodejs-nodemon | errata.rockylinux.org | 0:3.1.14-3.module+el9.8.0+40281+14cc6568.src, 0:3.1.14-3.module+el9.8.0+40281+14cc6568.noarch, 0:3.1.14-2.module+el8.10.0+40278+50b003a3.src, 0:3.1.14-2.module+el8.10.0+40278+50b003a3.noarch, 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e.src, 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e.noarch |
| nodejs-debuginfo | errata.rockylinux.org | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64 |
| nodejs-full-i18n | errata.rockylinux.org | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64 |
| nodejs24-npm | Amazon Linux | 1:11.19.1-1.24.22.1.1.amzn2023.0.1 |
| nodejs-22 | Chainguard | 22.23.4-r0 |
| nodejs24 | Amazon Linux | 1:24.22.1-1.amzn2023.0.1 |
| nodejs24-libs | Amazon Linux | 1:24.22.1-1.amzn2023.0.1 |
| nodejs-debugsource | errata.rockylinux.org | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64 |
22 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| nodejs | node | 22.23.3, 24.22.0, 26.12.0 |
| amazon:2023 | nodejs24-npm | 0 |
| chainguard | nodejs-22 | 0 |
| amazon:2023 | nodejs24 | 0 |
| amazon:2023 | nodejs24-libs | 0 |
| amazon:2023 | nodejs22-full-i18n | 0 |
| nodejs | node | 26.12.0, 22.23.3, 24.22.0 |
| amazon:2023 | nodejs24-devel | 0 |
| wolfi | nodejs-26 | 0 |
| amazon:2023 | nodejs22-libs | 0 |
| amazon:2023 | nodejs24-docs | 0 |
| amazon:2023 | nodejs22-devel | 0 |
| alpine | nodejs | 0, 0 |
| amazon:2023 | nodejs24-full-i18n | 0 |
| amazon:2023 | v8-12.4-devel | 0 |
| amazon:2023 | v8-13.6-devel | 0 |
| wolfi | nodejs-24 | 0 |
| amazon:2023 | nodejs22-docs | 0 |
| amazon:2023 | nodejs22 | 0 |
| wolfi | nodejs-22 | 0 |
…and 2 more
Timeline
- Oct 23, 2026 PoC Published
- Oct 23, 2026 CVE Published
- Oct 24, 2026 EPSS Score (3 in total, the first dated here)
- Oct 27, 2026 Security Advisory (3 in total, the first dated here)
- Oct 30, 2026 Distribution Patch (3 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-106069
vulnetix vdb fixes CVE-2026-106069Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-106069/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart