CVE-2026-106069

CVE-2026-106069 is a TLS certificate hostname verification bypass vulnerability in Node.js that occurs when a hostname loosely resolves to an IP address or only becomes an IP address after normalization. In affected versions, platform resolvers and normalization functions (such as `url.domainToASCII()`) can interpret non-canonical IP addresses differently. For example, a leading zero in an IP address like `0127.0.0.1` might be interpreted as octal by the normalization function (returning `87.0.0.1`), while the DNS lookup resolves it to `127.0.0.1`. Because Node.js would verify the certificate against the normalized IP, an attacker could use a certificate matching the normalized IP to authenticate a connection that actually routes to the resolved IP, potentially allowing for impersonation or man-in-the-middle attacks. The vulnerability affects Node.js release lines 26.x, 24.x, and 22.x. It was reported by security researcher `anagnorisis2peripeteia` and resolved by Matteo Collina. The fix, introduced in Node.js versions 26.12.1, 24.22.1, and 22.23.4, addresses the issue by rejecting any hostnames that only resolve to an IP address after normalization before any certificate matching takes place.