Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105483

Quick assessment

Affected
nodejs node
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node.js 在 TLS 主机名验证中存在一个缺陷：当主机名包含非 ASCII 字符（例如全角数字 ）时，即使证书中缺少与之匹配的 IP 地址主题备用名称（SAN），该证书仍可用于对 IPv4 地址建立认证连接。 未能将此类主机识别为 IP 地址，尽管它们经过规范化处理后能解析为标准的 IPv4 地址；相反，该函数将其与证书中的 DNS 名称和通用名称（Common Name）进行匹配。因此，包含 或 的证书可能被错误地接受，用于连接其并未被授权签发的 IP 端点。此问题是在修复 CVE-2026-48618 后

AI Predicted 7.5 Difficulty: Moderate

Affected Version Matrix 2

VendorProduct Version RangeStatus
nodejs node 24.22.0≤ 24.22.0 affected
26.12.0≤ 26.12.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105483

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nodejs node 24.22.0 ~ 24.22.0 -

II. Public POCs for CVE-2026-105483

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105483

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-105483 (1)

Same Patch Batch · nodejs · 2026-10-23 · 9 CVEs total

CVE-2026-105481 Node.js 22/24/26.x HTTP 代理连接重用漏洞
CVE-2026-105482 Node.js 22/24/26.x DNS 解析空字节截断漏洞
CVE-2026-106074 Node.js 22/24/26 crypto 快照熵缓存漏洞
CVE-2026-106069 Node.js 22/24/26 TLS 主机验证漏洞
CVE-2026-106071 Node.js 26.x 权限模型文件系统漏洞
CVE-2026-106070 Node.js 26.x 中 zlib.ZipFile API 的任意字节读取漏洞
CVE-2026-106072 Node.js 22/24/26 TLS 主机验证绕过漏洞
CVE-2026-106073 Node.js 22/24/26 权限模型文件路径绕过漏洞

IV. Related Vulnerabilities

Same product: node
Same vendor: nodejs
Same weakness: CWE-295

V. Comments for CVE-2026-105483

No comments yet

Leave a comment