---
id: CVE-2026-105483
title: >-
  A flaw in Node.js TLS hostname verification allows a certificate without a
  matching IP address SAN to authenticate a connection to an IPv4 address when
  the host is written with non-ASCII characters, such as fullwidth digits
  (`１２７.0.0.1`)…
summary: >-
  A flaw in Node.js TLS hostname verification allows a certificate without a
  matching IP address SAN to authenticate a connection to an IPv4 address when
  the host is written with non-ASCII characters, such as fullwidth digits
  (`１２７.0.0.1`)…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-295
vendor: nodejs
product: node
affected:
  - node >= 24.22.0 <= 24.22.0
  - node >= 26.12.0 <= 26.12.0
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T16:15:05.773Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105483'
references:
  - url: 'https://nodejs.org/en/blog/vulnerability/october-2026-security-releases'
tags:
  - cve.org
ingestedAt: '2026-10-23T16:31:11.320Z'
---

## Overview

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).

`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.

This vulnerability affects Node.js **26.x** and **24.x**.

## Affected

- `node >= 24.22.0 <= 24.22.0`
- `node >= 26.12.0 <= 26.12.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.