CVE-2026-106069
Quick assessment
Affected
nodejs node
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Node.js 在 TLS 主机名验证中存在一个缺陷：当主机名为带有前导零的非标准 IPv4 字面量（例如 ）时，服务器证书可能会被错误地针对一个与客户端实际连接地址不同的 IP 地址进行验证。 方法遵循 WHATWG URL 规范对主机名进行标准化处理，该规范将带有前导零的八位字节解释为八进制数（因此 会被解析为 ）；而实际的网络连接是通过操作系统解析器建立的，在某些平台（如 macOS）上，该解析器会将此类地址解释为十进制数（即 ）。这导致攻击者可以针对实际连接地址上的服务器，使用为另一个 IP 地址签发的证书
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106069
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.
`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-106069
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106069
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-106069 (1)
Same Patch Batch · nodejs · 2026-10-23 · 9 CVEs total
| CVE-2026-105481 | Node.js 22/24/26.x HTTP 代理连接重用漏洞 | |
| CVE-2026-105482 | Node.js 22/24/26.x DNS 解析空字节截断漏洞 | |
| CVE-2026-105483 | Node.js 24.x/26.x TLS 主机验证绕过漏洞 | |
| CVE-2026-106074 | Node.js 22/24/26 crypto 快照熵缓存漏洞 | |
| CVE-2026-106071 | Node.js 26.x 权限模型文件系统漏洞 | |
| CVE-2026-106070 | Node.js 26.x 中 zlib.ZipFile API 的任意字节读取漏洞 | |
| CVE-2026-106072 | Node.js 22/24/26 TLS 主机验证绕过漏洞 | |
| CVE-2026-106073 | Node.js 22/24/26 权限模型文件路径绕过漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-106069
No comments yet