Node.js TLS certificate hostname verification bypass via non-canonical IP address normalization

CVE-2026-106069 is a TLS certificate hostname verification bypass in Node.js's tls.checkServerIdentity() function. When a Node.js application connects to a host specified using a non-canonical IP address format — octal (0177.0.0.1), hex (0x7f.0.0.1), shorthand (127.1), decimal integer (2130706433), or fullwidth Unicode digits (１２７.0.0.1) — the runtime's net.isIP() returns false, treating the host as a domain name. After url.domainToASCII() normalization converts it to the canonical IP 127.0.0.1, the hostname checker compares against DNS SAN entries rather than IP Address SAN entries in the peer certificate. An attacker in a man-in-the-middle position could present a certificate whose DNS SAN matches the normalized IP, impersonating the intended server. All supported release lines are affected: 26.x before 26.12.1, 24.x before 24.22.1, and 22.x before 22.23.4. The fix, committed by Matteo Collina (tls: reject non-canonical IP addresses, commit d7663560ac), rejects any host that is not an IP per net.isIP() but becomes one after normalization, raising ERR_TLS_CERT_ALTNAME_INVALID before matching begins.

The Node.js project rates this HIGH — and from a pure protocol-correctness standpoint, that's defensible: a TLS hostname verification bypass is a fundamental certificate trust violation. But the vendor label doesn't account for the double prerequisite that makes this nearly impossible to trigger in production. First, the attacker needs a man-in-the-middle network position. Second — and this is the killer — the victim Node.js process must connect to the target server using a non-canonical IP string. Production applications don't do this. Standard code uses DNS hostnames or properly formatted IPs; configuration files, environment variables, and orchestration systems all emit canonical addresses. The non-canonical formats (octal, hex, shorthand, fullwidth) are testing curiosities, not production patterns. The vendor HIGH is a reasonable *theoretical* rating, but real-world exploitability is MEDIUM at best.

Sources.

1. Node.js October 2026 Security Releases (official advisory)
2. Node.js commit d7663560ac — tls: reject non-canonical IP addresses
3. Node.js v24.22.1 release notes
4. Lilting.ch — Node.js v24.22.1 fixes four HIGH CVEs
5. Astra Security — Node.js October 2026 Security Release analysis
6. CyberSecurityNews — Node.js Releases Security Updates
7. SecurityOnline — Node.js Fixes 10 Flaws Including TLS Hostname Bypasses
8. TuxCare — 10 Node.js CVEs, a Brotli RCE, and What to Do If Your Version Is EOL

Run this script on each Node.js host (application server, CI runner, container image) to check the installed Node.js version against patched releases. Requires no special privileges — any user who can run node --version is sufficient. Example: chmod +x check_cve_2026_106069.sh && ./check_cve_2026_106069.sh or for a container: docker run --rm <image> node -e "$(cat check_cve_2026_106069.sh)"

#!/usr/bin/env bash
# check_cve_2026_106069.sh
# Checks whether the installed Node.js version is patched against
# CVE-2026-106069 (TLS hostname bypass via non-canonical IP addresses)
# Patched versions: 22.23.4+, 24.22.1+, 26.12.1+
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

if ! command -v node &>/dev/null; then
  echo "UNKNOWN — Node.js is not installed or not in PATH"
  exit 2
fi

NODE_VERSION=$(node --version 2>/dev/null | sed 's/^v//')
if [[ -z "$NODE_VERSION" ]]; then
  echo "UNKNOWN — could not determine Node.js version"
  exit 2
fi

# Split version into major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$NODE_VERSION"

# Remove any pre-release suffix from PATCH
PATCH=${PATCH%%-*}

echo "Detected Node.js version: $NODE_VERSION (major=$MAJOR minor=$MINOR patch=$PATCH)"

# Version comparison logic
check_version() {
  local maj=$1 min=$2 pat=$3
  local fix_maj=$4 fix_min=$5 fix_pat=$6
  if (( maj > fix_maj )); then return 0; fi
  if (( maj == fix_maj && min > fix_min )); then return 0; fi
  if (( maj == fix_maj && min == fix_min && pat >= fix_pat )); then return 0; fi
  return 1
}

case $MAJOR in
  22)
    if check_version "$MAJOR" "$MINOR" "$PATCH" 22 23 4; then
      echo "PATCHED — Node.js $NODE_VERSION >= 22.23.4"
      exit 0
    else
      echo "VULNERABLE — Node.js $NODE_VERSION < 22.23.4 (CVE-2026-106069)"
      exit 1
    fi
    ;;
  24)
    if check_version "$MAJOR" "$MINOR" "$PATCH" 24 22 1; then
      echo "PATCHED — Node.js $NODE_VERSION >= 24.22.1"
      exit 0
    else
      echo "VULNERABLE — Node.js $NODE_VERSION < 24.22.1 (CVE-2026-106069)"
      exit 1
    fi
    ;;
  26)
    if check_version "$MAJOR" "$MINOR" "$PATCH" 26 12 1; then
      echo "PATCHED — Node.js $NODE_VERSION >= 26.12.1"
      exit 0
    else
      echo "VULNERABLE — Node.js $NODE_VERSION < 26.12.1 (CVE-2026-106069)"
      exit 1
    fi
    ;;
  23|25)
    echo "VULNERABLE — Node.js $NODE_VERSION is an EOL odd-numbered release with no security patch available"
    exit 1
    ;;
  *)
    if (( MAJOR > 26 )); then
      echo "PATCHED — Node.js $NODE_VERSION is a newer major version (post-fix)"
      exit 0
    elif (( MAJOR < 22 )); then
      echo "VULNERABLE — Node.js $NODE_VERSION is EOL and will not receive a patch for CVE-2026-106069"
      exit 1
    else
      echo "UNKNOWN — unexpected Node.js major version $MAJOR"
      exit 2
    fi
    ;;
esac