Zero Radar
← feed
HighVulnerabilityCVE-2026-105483updated 28 Oct 2026, 20:43 UTC

Node.js TLS check can accept wrong certificate for IP addresses written with special digits

Node.js can be tricked into trusting a server's certificate for the wrong IP address when the address is typed with unusual full-width digits. An attacker in the network path could then impersonate that server.

Fix availableOfficial, 4 sources
SeverityHighCVSS 7.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesFixes were released by Node.js on October 21, 2026 for the 22.x, 24.x and 26.x release lines; update to the patched Node.js releases from that Security Release. · since 27 Oct 2026
How sure is this?Official, 4 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker on network pathPositioned between client and server
  2. 2IP written with fullwidth digitsHost like １２７.0.0.1 sent by client
  3. 3Node.js skips IP checkTreats host as a name, not an IP
  4. 4Wrong certificate acceptedDNS:127.0.0.1 cert matches incorrectly
  5. ResultConnection trusted for the wrong server

What happened

In Node.js, tls.checkServerIdentity() does not recognize hosts written with non-ASCII characters (such as fullwidth digits) as IPv4 addresses, so it matches them against certificate DNS names and Common Name instead of IP SANs. A certificate such as DNS:127.0.0.1 or DNS:*.0.0.1 can then be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.

Why it is dangerous: A man-in-the-middle could intercept or alter TLS connections that Node.js clients make to IP-addressed endpoints, exposing traffic or credentials. Services and tools built on Node.js that connect to servers by IP address are at risk.

Are you affected?

You are affected if you run Node.js 26.x or 24.x and your application or tooling makes TLS connections that depend on certificate hostname verification.

Node.js 26.x; Node.js 24.x

What to do

  1. Update Node.js 26.x and 24.x to the patched release from the October 21, 2026 Node.js Security Release
  2. Check that applications and services pinned to these versions are rebuilt and redeployed with the updated runtime
  3. Review any TLS connections to IP addresses in critical systems for unexpected certificate acceptance

Timeline

  1. 23 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 17:17 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 17:01 UTC
    Fortinet PSIRT reported on it · Fortinet PSIRT
  4. 26 Oct 2026, 17:12 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 21:32 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  6. 27 Oct 2026, 21:32 UTC
    Fix: unknown
  7. 28 Oct 2026, 20:36 UTC
    Reported by Cisco PSIRT · Cisco PSIRT

Sources 5 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-105483 · GHSA-8h4p-qpcq-gq24
CVSS
7.4 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 17:17 UTC
On Zero Radar
before the radar started
Last change
28 Oct 2026, 20:43 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Node.js TLS check can accept wrong certificate for IP addresses written with special digits · Zero Radar