Node.js TLS certificate hostname verification bypass via fullwidth Unicode IP digits

#!/usr/bin/env bash
# check_cve_2026_105483.sh — Detect CVE-2026-105483 (Node.js TLS fullwidth IP bypass)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

NODE_BIN="${1:-node}"

if ! command -v "$NODE_BIN" &>/dev/null; then
  echo "UNKNOWN — '$NODE_BIN' not found in PATH"
  exit 2
fi

VERSION_RAW=$($NODE_BIN --version 2>/dev/null) || { echo "UNKNOWN — failed to get version"; exit 2; }
# Strip leading 'v'
VERSION="${VERSION_RAW#v}"

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

# Node.js 22.x and below: NOT AFFECTED
if [ "$MAJOR" -le 22 ]; then
  echo "PATCHED — $VERSION_RAW (v22.x and below are not affected by CVE-2026-105483)"
  exit 0
fi

# Node.js 23.x, 25.x: EOL / non-LTS lines — check if they got a fix
# These lines are not listed as affected; treat as unknown
if [ "$MAJOR" -eq 23 ] || [ "$MAJOR" -eq 25 ]; then
  echo "UNKNOWN — $VERSION_RAW (v${MAJOR}.x not listed in advisory; verify manually)"
  exit 2
fi

# Node.js 24.x: fixed in 24.22.1
if [ "$MAJOR" -eq 24 ]; then
  if [ "$MINOR" -gt 22 ]; then
    echo "PATCHED — $VERSION_RAW (> 24.22.1)"
    exit 0
  elif [ "$MINOR" -eq 22 ] && [ "$PATCH" -ge 1 ]; then
    echo "PATCHED — $VERSION_RAW (>= 24.22.1)"
    exit 0
  else
    echo "VULNERABLE — $VERSION_RAW (CVE-2026-105483: upgrade to >= 24.22.1)"
    exit 1
  fi
fi

# Node.js 26.x: fixed in 26.12.1
if [ "$MAJOR" -eq 26 ]; then
  if [ "$MINOR" -gt 12 ]; then
    echo "PATCHED — $VERSION_RAW (> 26.12.1)"
    exit 0
  elif [ "$MINOR" -eq 12 ] && [ "$PATCH" -ge 1 ]; then
    echo "PATCHED — $VERSION_RAW (>= 26.12.1)"
    exit 0
  else
    echo "VULNERABLE — $VERSION_RAW (CVE-2026-105483: upgrade to >= 26.12.1)"
    exit 1
  fi
fi

# Node.js 27+: assume fixed (post-release)
if [ "$MAJOR" -ge 27 ]; then
  echo "PATCHED — $VERSION_RAW (v27+ post-dates the fix)"
  exit 0
fi

echo "UNKNOWN — $VERSION_RAW (unexpected version)"
exit 2