The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Oct 28, 2026 | Oct 23, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs24-develUpgrade nodejs24-docsUpgrade nodejs22-full-i18nUpgrade v8-13.6-develUpgrade nodejs22-debuginfoUpgrade nodejs22-npmUpgrade nodejs22-libsUpgrade v8-12.4-develUpgrade nodejs22-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24Upgrade nodejs22Upgrade nodejs22-docsUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-develUpgrade nodejs24-libsUpgrade nodejs24-full-i18n | Oct 28, 2026 | Oct 23, 2026 |
| Nodejs | — | Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later | Oct 28, 2026 | Oct 23, 2026 |
| Redhat_linux | — | No solution exists | Oct 27, 2026 | Oct 23, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub