Zero Radar
← feed
HighVulnerabilityCVE-2026-106069updated 28 Oct 2026, 20:43 UTC

Node.js certificate check can accept a server for the wrong IP address

A Node.js program connecting to a server by a specially written IP address (with a leading zero) may trust a certificate meant for a different address. An attacker in the network path could then impersonate the server.

Fix availableOfficial, 4 sources
SeverityHighCVSS 7.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesFixes announced by Node.js on October 21, 2026 for the 22.x, 24.x, and 26.x release lines (exact fixed version numbers not stated in the material) · since 28 Oct 2026
How sure is this?Official, 4 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker on network pathPositions itself between client and server
  2. 2Client connects by IPAddress written with a leading zero
  3. 3Certificate checked wronglyNormalized IP differs from connected IP
  4. 4Impostor acceptedCertificate for another IP is trusted
  5. ResultClient trusts an impostor server

What happened

Node.js tls.checkServerIdentity() normalizes non-canonical IPv4 literals with leading zeros (e.g. 0127.0.0.1) as octal per WHATWG URL rules, while the OS resolver may read them as decimal on some platforms such as macOS, so the certificate is checked against a different IP than the one connected to.

Why it is dangerous: Traffic meant for one server can be intercepted or redirected to an attacker who presents a certificate for another IP, exposing data sent over TLS. Services and tools in Node.js that connect to IP addresses written with leading zeros are at risk.

Are you affected?

You are affected if you run Node.js 22.x, 24.x, or 26.x (prior to the fixed releases) and your code makes TLS connections to IPv4 addresses written with leading zeros, especially on platforms where the OS resolver reads them as decimal.

Node.js 22.x, 24.x, 26.x (Cisco products listed as affected in its October 2026 advisory; specific product list not stated in the material)

What to do

  1. Update Node.js to the patched 22.x, 24.x, or 26.x release published on or after October 21, 2026
  2. Review code that connects to IP addresses written with leading zeros and use canonical dotted-decimal addresses instead
  3. Check Cisco or Fortinet product advisories if you use affected vendor software bundling Node.js

Timeline

  1. 23 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 17:17 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 17:01 UTC
    Fortinet PSIRT reported on it · Fortinet PSIRT
  4. 26 Oct 2026, 17:12 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 21:32 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  6. 28 Oct 2026, 20:36 UTC
    Reported by Cisco PSIRT · Cisco PSIRT
  7. 28 Oct 2026, 20:43 UTC
    Fix: Fixes announced by Node.js on October 21, 2026 for the 22.x, 24.x, and 26.x release lines (exact fixed version numbers not stated in the material)

Sources 5 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-106069 · GHSA-jj44-m59q-wmrj
CVSS
7.4 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 17:17 UTC
On Zero Radar
before the radar started
Last change
28 Oct 2026, 20:43 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Node.js certificate check can accept a server for the wrong IP address · Zero Radar