CVE-2026-106072

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1. tls.checkServerIdentity() did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing DNS:127.0.0.1 and no IP Address:127.0.0.1 SAN was therefore accepted, while the same certificate is correctly rejected for 127.0.0.1. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1. tls.checkServerIdentity() did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing DNS:127.0.0.1 and no IP Address:127.0.0.1 SAN was therefore accepted, while the same certificate is correctly rejected for 127.0.0.1. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1.

tls.checkServerIdentity() did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing DNS:127.0.0.1 and no IP Address:127.0.0.1 SAN was therefore accepted, while the same certificate is correctly rejected for 127.0.0.1. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1.

tls.checkServerIdentity() did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing DNS:127.0.0.1 and no IP Address:127.0.0.1 SAN was therefore accepted, while the same certificate is correctly rejected for 127.0.0.1. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1.

tls.checkServerIdentity() did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing DNS:127.0.0.1 and no IP Address:127.0.0.1 SAN was therefore accepted, while the same certificate is correctly rejected for 127.0.0.1. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

• CVE-2026-105482: reject names and local addresses with null bytes in the dns resolve*() and setLocalAddress() APIs, so c-ares can no longer silently truncate the queried name
• CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in tls.checkServerIdentity() and restore IPv6 IP SAN matching, broken by the CVE-2026-48618 fix since els15
• CVE-2026-105481: check for unread data in the OS socket buffer before http.Agent reuses a keep-alive socket and destroy the socket if any

• CVE-2026-105482: reject names and local addresses with null bytes in the dns resolve*() and setLocalAddress() APIs, so c-ares can no longer silently truncate the queried name
• CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in tls.checkServerIdentity() and restore IPv6 IP SAN matching, broken by the CVE-2026-48618 fix since els15
• CVE-2026-105481: check for unread data in the OS socket buffer before http.Agent reuses a keep-alive socket and destroy the socket if any

This update for nodejs22 fixes the following issues:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

• Update to 22.23.4:
• CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)
• CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)
• CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)
• CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)
• CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)
• CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update sqlite to 3.53.4
• deps: update undici to 6.29.1
• deps: update corepack to 0.36.0
• deps: upgrade npm to 10.9.9
• deps: update icu to 78.3
• node-api: support SharedArrayBuffer in napi_create_typedarray
• node-api: add napi_create_external_sharedarraybuffer

This update for nodejs22 fixes the following issues:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

• Update to 22.23.4:
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update sqlite to 3.53.4
• deps: update undici to 6.29.1
• Update to 22.23.3:
• deps: update corepack to 0.36.0
• deps: upgrade npm to 10.9.9
• deps: update icu to 78.3
• deps: update Undici to 6.28.1
• node-api: support SharedArrayBuffer in napi_create_typedarray
• node-api: add napi_create_external_sharedarraybuffer

This update for nodejs22 fixes the following issues:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

• Update to 22.23.4:
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update sqlite to 3.53.4
• deps: update undici to 6.29.1
• Update to 22.23.3:
• deps: update corepack to 0.36.0
• deps: upgrade npm to 10.9.9
• deps: update icu to 78.3
• deps: update Undici to 6.28.1
• node-api: support SharedArrayBuffer in napi_create_typedarray
• node-api: add napi_create_external_sharedarraybuffer

This update for nodejs24 fixes the following issues:

Security issues fixed:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Non security issue fixed:

• 'npm install -h' output is truncated (bsc#1276224).

Changes for nodejs24:

• Update to 24.22.1:
• crypto: update root certificates to NSS 3.131.1
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update undici to 7.30.1
• Update to 24.22.0:
• crypto: add crypto.parsePKCS12()
• crypto: discover ciphers and hashes from OpenSSL providers
• crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
• doc: deprecate Server.prototype._listen2 in node:net
• net: support sending net.BoundSocket to threads and child processes
• perf_hooks: implement SlidingWindowHistogram
• perf_hooks: implement qrde analysis support in Histogram
• perf_hooks: implement Histogram meanCI API
• perf_hooks: add CBOR export/import for histogram exchange
• sqlite: add StatementSync.prototype.close()
• sqlite: add StatementSync.prototypeSymbol.dispose
• src,lib: add util.markPromiseAsHandled
• util: implement util.throttle
• util: implement debounce
• Update to 24.21.0:
• crypto: update root certificates to NSS 3.126
• crypto: support loading private keys through STORE loaders
• deps: update Undici to 7.29.1
• lib,src: improve histogram implementation
• net: improve performance of net.BlockList
• perf_hooks: add statistical hypothesis testing to histogram
• util: add non-throwing MIMEType.parse
• Update to 24.20.0:
• async_hooks: add using scopes to AsyncLocalStorage
• buffer: add end parameter
• doc: add MikeMcC399 as collaborator
• lib,permission: add permission.drop
• loader: implement package maps
• src,permission: add --permission-audit
• stream: add node:stream/iter implementation
• test_runner: add context.log() and test:log event
• test_runner: report entryFile in TestStream events
• wasm: enable JSPI
• Update to 24.19.0:
• buffer: implement blob.textStream()
• deps: update OpenSSL build config to support compression
• doc: update blockList stability status to release candidate
• doc: mark stream.compose stable
• esm: add --experimental-import-text flag
• fs: support caller-supplied readFile() buffers
• http: add httpValidation option to configure header value validation
• net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
• perf_hooks: sample delay per event loop iteration
• src: allow empty --experimental-config-file
• stream: expose ReadableStreamTee
• tls: report negotiated TLS groups
• tls: add certificateCompression option