CVE-2026-105483

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**.

• CWE-295

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105472A weakness has been identified in girishsaraf Online-Appoint…6.3
• CVE-2026-105474A server-side template injection exists in SolusVM 2 up to v…9.4
• CVE-2026-105477A vulnerability in Veeam Agent for Linux allows for local pr…7.3
• CVE-2026-10548A security flaw has been discovered in NousResearch hermes-a…5.3
• CVE-2026-105481A flaw in Node.js HTTP Agent connection reuse can cause a cl…6.5
• CVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing…7.4
• CVE-2026-105484A security vulnerability has been detected in TOTOLINK X6000…10
• CVE-2026-105485Authentication bypass OAuth device authorization flow in Dev…6.8
• CVE-2026-105486A vulnerability was detected in OSSRS srs up to 7.0-a1. This…7.3
• CVE-2026-105487A vulnerability was found in yogeshojha reNgine up to 2.2.0.…6.3
• CVE-2026-105488Missing authorization in the global vault in Devolutions Ser…7.1
• CVE-2026-105489Adobe Campaign Classic (ACC) is affected by an Improper Neut…9.9