node: Improper Certificate Validation
CVE-2026-106069 is a high-severity improper certificate validation vulnerability in node from Node.js, with a CVSS 3.0 base score of 7.4 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected node versions: 22.23.3 and earlier; 24.22.0 and earlier; 26.12.0 and earlier. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.3% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Check which version of node you run against the affected versions below, and install the vendor's latest release.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Node.js | node | 22.23.3 and earlier; 24.22.0 and earlier; 26.12.0 and earlier | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. Scored by CNA (hackerone.com).
Official description
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How developers prevent this class of flaw
- Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
- If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
More Improper Certificate Validation vulnerabilities (CWE-295)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
Other vulnerabilities in node
- 7.5 High severity
- 7.5 High severity
- 8.1 High severity
- 7.5 High severity
- 7.5 High severity
- 8.1 High severity
Recent Improper Certificate Validation vulnerabilities
- 7.4 High severity
- 9.1 Critical severity
- 9.1 Critical severity
- 9.1 Critical severity
- 8.7 High severity
- 10.0 Critical severity
Spotted an error? Tell us.