CVE-2026-106072 nodejs CVE debrief

Who should care

Defenders responsible for Node.js deployments using TLS, especially those with certificates containing DNS SANs, should assess exposure and verify remediation. They should prioritize verifying Node.js deployments using TLS for exposure, especially where certificates with DNS SANs are used, and check certificates with DNS SANs issued by trusted CAs for potential authentication issues. Defenders should also review compensating controls for exposed systems,

Why it matters

Defenders should care about CVE-2026-106072 because it affects Node.js TLS hostname verification, potentially allowing certificate authentication issues with non-canonical IPv4 spellings.

• Potential authentication issues with certificates containing DNS SANs.
• Exposure of Node.js deployments using non-canonical IPv4 spellings.
• Verification priority for certificates issued by trusted CAs.
• Remediation priority for affected Node.js versions (26.x, 24.x, 22.x).

Technical summary

The tls.checkServerIdentity() function did not classify non-canonical IPv4 spellings as IP addresses, allowing a certificate with a DNS SAN to authenticate an IP endpoint. This vulnerability affects Node.js 26.x, 24.x, and 22.x, and requires a certificate with a numeric DNS SAN issued by a CA trusted by the client. Defenders should prioritize verifying Node.js deployments using TLS for exposure, especially where certificates with DNS SANs are used, and check certificates with DNS SANs issued by trusted CAs for potential authentication issues.

Defensive priority

Defenders should prioritize verifying Node.js deployments using TLS for exposure, especially where certificates with DNS SANs are used.

Recommended defensive actions

• Verify Node.js deployments using TLS for exposure, especially where certificates with DNS SANs are used.
• Check certificates with DNS SANs issued by trusted CAs for potential authentication issues.
• Update Node.js to the latest version if using affected versions (26.x, 24.x, 22.x).
• Monitor platform resolver configurations for potential vulnerabilities.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its impact and remediation require verification from official Node.js sources. The vulnerability allows certificate authentication issues with non-canonical IPv4 spellings, affecting Node.js deployments using TLS, especially those with certificates containing DNS SANs. Defenders should verify Node.js deployments for exposure and check certificates with DNS SANs issued by trusted CAs for potential authentication issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.