Vulnpedia
← Search CVEs

CVE-2026-106072

MEDIUM 6.7

Published 2026-10-23 · Last modified 2026-10-23

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 46th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

6.7CVSS 3.0 · MEDIUM

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires an admin / high-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Nodejs

Products Node

Weakness (CWE)

  • CWE-295: Improper Certificate Validation

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

References and research data (JSON)

Vendor product assessments

Showing 32 of 67 vendor product statements; 35 omitted. Read the full vendor advisory.

  • nodejs as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-docs as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-docs

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-npm as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-npm

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs24 as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs24

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs24-full-i18n as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs24-full-i18n

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs24-npm as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs24-npm

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs26.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs26?arch=src

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-nodemon.src (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-nodemon?arch=src&rpmmod=nodejs:24

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-nodemon (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-nodemon?rpmmod=nodejs:24

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-packaging.src (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-packaging?arch=src&rpmmod=nodejs:22

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-packaging (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-packaging?rpmmod=nodejs:22

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?rpmmod=nodejs:24

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • npm (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/npm?rpmmod=nodejs:24

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • v8-13.6-devel (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/v8-13.6-devel?rpmmod=nodejs:22

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-full-i18n (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:26

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?rpmmod=nodejs:22

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • npm (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/npm?rpmmod=nodejs:22

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • npm (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/npm?rpmmod=nodejs:26

    • workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input (CME-1314 Input Canonicalization Before Security Decision: https://cmetaxonomy.org/entries/CME-1314.html). Where feasible, pin expected server certificates or public keys for sensitive outbound TLS (CME-404 Certificate Pinning: https://cmetaxonomy.org/entries/CME-404.html). Restrict which destinations Node.js workloads may reach with egress controls (CME-208: https://cmetaxonomy.org/entries/CME-208.html; CME-203: https://cmetaxonomy.org/entries/CME-203.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • hi/nodejs as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/nodejs?repository_url=registry.redhat.io/hi/nodejs

    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs20.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs20?arch=src

    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs22.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs22?arch=src

    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs24.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs24?arch=src

    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs25.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs25?arch=src

    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00
  • nodejs26.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs26?arch=src

    Red Hat · CVE-2026-106072 · Updated 2026-10-26T11:03:11+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate

All CVSS metrics

  • MEDIUM 6.7 v3.0 · CNA Primary
    CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
  • MEDIUM 6.7 v3.0 · NVD Secondary
    CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS