CVE-2026-106072

**CVE-2026-106072** is a certificate validation vulnerability in Node.js that affects the 22.x, 24.x, and 26.x release lines. The issue arises when a client attempts to connect to an IPv4 address written in a non-canonical format, such as a shortened or hexadecimal string. Because Node.js fails to recognize these non-standard formats as IP addresses during TLS hostname verification, it falls back to matching the certificate's DNS Subject Alternative Names (SANs) instead of its IP address entries. However, the underlying operating system still resolves and connects to the numeric IP address. This discrepancy allows an attacker who possesses a certificate with a DNS SAN matching the non-canonical string to authenticate an IP endpoint that the certificate was never meant to cover, potentially establishing a verified TLS session. This scenario is particularly relevant in environments utilizing private PKI, internal CAs, or mutual TLS. The vulnerability was addressed in the Node.js security updates released on October 21, 2026 (specifically versions 22.23.4, 24.22.1, and 26.12.1) by ensuring that TLS rejects non-canonical IP addresses and correcting hostname normalization checks.