CVE-2026-105483: when an IPv4 address is checked as a DNS name

CVE-2026-105483: when an IPv4 address is checked as a DNS name Node.js applications often treat an IP address as the least ambiguous destination possible. CVE-2026-105483 shows why that assumption deserves scrutiny. In affected 24.x and 26.x releases, tls.checkServerIdentity() can evaluate a host written with fullwidth digits as a DNS name even though the same host normalizes and resolves to an IPv4 address. A certificate containing a matching DNS subject alternative name can then authenticate the connection without an IP address SAN. The Node.js project published the fix in 24.22.1 and 26.12.1 on October 21, 2026. It rates the bug High. The GitHub advisory records CVSS v3.0 7.4 with network access, high attack complexity, no privileges or user interaction, and high confidentiality and integrity impact. The weakness is CWE-295, improper certificate validation. The identity mismatch TLS hostname verification asks a narrower question than DNS resolution. The client must decide what kind of identity it intended to contact, then compare the peer certificate with that identity. For a name, a DNS SAN is appropriate. For an IP address, the certificate should carry a matching IP address SAN. The vulnerable path classified a fullwidth-digit host as something other than an IP address. It still normalized and resolved the host as IPv4. Verification then checked DNS names and the certificate Common Name. An attacker who can present a trusted certificate with a numeric DNS SAN could therefore satisfy the wrong identity check. This is a regression introduced after the fix for CVE-2026-48618. The relevant distinction isn't whether the connection eventually uses TCP over IPv4. It is whether certificate verification understands that the endpoint is an IP address at the point where identity policy is applied. Conditions for exploitation Several conditions must align: The client runs an affected Node.js 24.x or 26.x release. The application connects to a host represented with fullwidth digits. The host resolves to the IPv4 endpoint controlled by, or reachable by, the attacker. The server certificate chains to a CA trusted by the client. The certificate contains a DNS SAN matching the normalized address, such as 127.0.0.1 or an applicable wildcard, and no matching IP SAN is required. An internet-facing Node.js process is not automatically vulnerable. The application must place the affected hostname flow in a security-relevant path. Common examples include user-supplied callback URLs, connector configuration, proxy targets, or integrations that accept destination addresses from another system. A hard-coded DNS name with ordinary TLS handling may never exercise the bug. Impact Successful exploitation defeats the identity binding TLS is expected to provide. The client can establish a session with an unintended endpoint while treating the peer certificate as valid. That can expose request data, credentials carried inside the session, and response integrity. The advisory assigns high confidentiality and integrity impact, though availability impact is absent. The existence of a trusted certificate does not imply that the attacker is a public CA or that every internal CA is affected in the same way. The practical question is whether the client trusts a certificate chain that contains the attacker's chosen identity. Internal PKI, test CAs, and delegated certificate issuance can alter that answer. Affected scope The official advisory limits affected versions to Node.js 24.x before 24.22.1 and 26.x before 26.12.1. The same October release also fixed issues in the 22.x line, but this CVE is not listed as affecting 22.x. Teams should read the full release notes instead of applying one version rule to every CVE from that date. Applications that share a supported but older runtime through containers, embedded runtimes, or managed build images need the same check. A package manifest can say one version while the deployed process executes another. Record the runtime reported by the actual process and the image digest used to deploy it. Exposure context On November 2, 2026 at 04:17 +08:00, ZoomEye Search app="Node.js" returned 5,539,674 product-fingerprint matches. Filter vul.cve="CVE-2026-105483" returned zero. Exposure is the larger selected count and represents Node.js fingerprints, not confirmed vulnerable deployments. That distinction matters for prioritization. The count can help identify a broad technology population, but it cannot establish the running version, the application's TLS destination policy, or the trust anchors in use. Version and code-path evidence remain necessary. Remediation Upgrade to Node.js 24.22.1 or 26.12.1, or a later release on a supported line. Rebuild container images and redistributed binaries so old runtimes are not reintroduced during deployment. Verify the runtime inside the running application and the build artifact, not just the source dependency declaration. As a temporary reduction measure, reject user-controlled non-ASCII host strings and require canonical ASCII DNS names or canonical IPv4 addresses before the TLS client is invoked. This can narrow the affected input path, but it is not a substitute for the patched runtime. Review custom certificate verification callbacks because bypassing the standard check can preserve a separate identity flaw. Assurance Add a regression test with an isolated test CA and a certificate that contains a numeric DNS SAN but no matching IP SAN. The fixed runtime should reject that certificate when the destination is an IP endpoint. Test the deployed binary, not only application code, and retain the fixture so a future dependency rollback fails visibly. References Node.js October 21, 2026 Security Releases Node.js 24.22.1 release notes Node.js 26.12.1 release notes GitHub Advisory GHSA-8h4p-qpcq-gq24 ZoomEye Search