Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106072

Quick assessment

Affected
nodejs node
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node.js 在 TLS 主机名验证中存在一个缺陷：当客户端使用非标准的 IPv4 地址格式（例如 、 、 或 ）连接时，仅包含 DNS 类型主题备用名称（SAN）的证书竟可被用于验证 IP 端点。 函数未能将上述主机名识别为 IP 地址，而是将其规范化为规范形式，再与证书中的 DNS 名称进行匹配。因此，若证书中包含 但缺少对应的 SAN，该证书仍会被接受；而若直接使用标准格式 ，同一证书则会被正确拒绝。利用此漏洞需要满足两个条件：一是客户端信任的证书颁发机构（CA）签发了一张包含数字 DNS SAN 的证书；

AI Predicted 7.5 Difficulty: Moderate

Affected Version Matrix 3

VendorProduct Version RangeStatus
nodejs node 22.23.3≤ 22.23.3 affected
24.22.0≤ 24.22.0 affected
26.12.0≤ 26.12.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106072

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nodejs node 22.23.3 ~ 22.23.3 -

II. Public POCs for CVE-2026-106072

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106072

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-106072 (1)

Same Patch Batch · nodejs · 2026-10-23 · 9 CVEs total

CVE-2026-105481 Node.js 22/24/26.x HTTP 代理连接重用漏洞
CVE-2026-105482 Node.js 22/24/26.x DNS 解析空字节截断漏洞
CVE-2026-105483 Node.js 24.x/26.x TLS 主机验证绕过漏洞
CVE-2026-106074 Node.js 22/24/26 crypto 快照熵缓存漏洞
CVE-2026-106069 Node.js 22/24/26 TLS 主机验证漏洞
CVE-2026-106071 Node.js 26.x 权限模型文件系统漏洞
CVE-2026-106070 Node.js 26.x 中 zlib.ZipFile API 的任意字节读取漏洞
CVE-2026-106073 Node.js 22/24/26 权限模型文件路径绕过漏洞

IV. Related Vulnerabilities

Same product: node
Same vendor: nodejs
Same weakness: CWE-295

V. Comments for CVE-2026-106072

No comments yet

Leave a comment