CVE-2026-106069
HIGH 7.4A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Severe if exploited (CVSS 7.4), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 20th percentile
Impact if exploited
7.4CVSS 3.0 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-295: Improper Certificate Validation
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References and research data (JSON)
Vendor product assessments
Showing 32 of 67 vendor product statements; 35 omitted. Read the full vendor advisory.
nodejs as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-docs as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-docs
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-npm as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-npm
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs24 as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs24
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs24-full-i18n as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs24-full-i18n
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs24-npm as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs24-npm
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs26.src as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs26?arch=src
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-nodemon.src (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-nodemon?arch=src&rpmmod=nodejs:24
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-nodemon (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-nodemon?rpmmod=nodejs:24
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-packaging.src (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-packaging?arch=src&rpmmod=nodejs:22
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-packaging (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-packaging?rpmmod=nodejs:22
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs?rpmmod=nodejs:24
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
npm (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/npm?rpmmod=nodejs:24
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
v8-13.6-devel (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/v8-13.6-devel?rpmmod=nodejs:22
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-full-i18n (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:26
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
nodejs (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nodejs?rpmmod=nodejs:22
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
npm (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/npm?rpmmod=nodejs:22
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
npm (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/npm?rpmmod=nodejs:26
- workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.
- none available: Affected
hi/nodejs as a component of Red Hat Hardened Images · known not affected
Vendor assessment for this product only.
Reason: component not present
pkg:oci/nodejs@sha256:0b09273472d5eb02bd56df5e97aa44a9d6f406e117baef591d1edabdd4aa844a?repository_url=registry.redhat.io/hi/nodejs
Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00nodejs20.src as a component of Red Hat Hardened Images · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/[email protected]?arch=src
Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00nodejs22.src as a component of Red Hat Hardened Images · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/nodejs22?arch=src
Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00nodejs24.src as a component of Red Hat Hardened Images · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/nodejs24?arch=src
Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00nodejs25.src as a component of Red Hat Hardened Images · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/[email protected]?arch=src
Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00nodejs26.src as a component of Red Hat Hardened Images · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/nodejs26?arch=src
Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
1 candidate
- https://github.com/CompleTetech-Security/node-cve-2026-106069-check
Offline Node.js evidence checker for CVE-2026-106069: TLS leading-zero IPv4 resolver mismatch. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
PoC-in-GitHub · CVE-2026-106069
PoC-in-GitHub · CVE-2026-106069 · Updated 2026-10-26T05:06:59Z
All CVSS metrics
- HIGH 7.4 v3.0 · CNA Primary
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - HIGH 7.4 v3.0 · NVD Secondary
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106069.json Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109107 EUVD · EUVD-2026-109107
Technical & other
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases CVE record · hackerone · Updated 2026-10-23T16:15:05.850Z
NVD · CVE-2026-106069 · Updated 2026-10-23T19:42:24.553
Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00 - https://access.redhat.com/security/cve/CVE-2026-106069 Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2559873 Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-106069 Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-106069 Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00
- https://nodejs.org/en/blog/release/v22.23.4 Red Hat · CVE-2026-106069 · Updated 2026-10-23T18:19:39+00:00