CVE catalog

CVE-2026-106072

nodejs: CVE-2026-106072

[CVE catalog]

Severity
Medium · CVSS 6.7CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.55% · Oct 25, 2026

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannodejssid24.22.1+dfsg+~cs24.19.2-1fixed
Debiannodejsforky24.21.0+dfsg+~cs24.13.4-1vulnerable
Debiannodejstrixie20.19.2+dfsg-1+deb13u2vulnerable
Debiannodejstrixie-security20.19.2+dfsg-1+deb13u3vulnerable
Debiannodejsbookworm18.20.4+dfsg-1~deb12u2vulnerable
Debiannodejsbookworm-security18.20.4+dfsg-1~deb12u3vulnerable
Ubuntunodejspro12.22.5~dfsg-5ubuntu1vulnerable
Ubuntunodejspro12.22.7~dfsg-2ubuntu1vulnerable
Ubuntunodejspro12.22.7~dfsg-2ubuntu3vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu2vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.1vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.2vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.3vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.4vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.5vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.6vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.6+esm2vulnerable
Ubuntunodejs24.0418.13.0+dfsg1-1ubuntu2vulnerable
Ubuntunodejs24.0418.19.1+dfsg-2ubuntu4vulnerable
Ubuntunodejs24.0418.19.1+dfsg-6ubuntu1vulnerable
Ubuntunodejs24.0418.19.1+dfsg-6ubuntu2vulnerable
Ubuntunodejs24.0418.19.1+dfsg-6ubuntu5vulnerable
Ubuntunodejs26.1022.22.1+dfsg+~cs22.19.15-1ubuntu1vulnerable
Ubuntunodejs26.1024.16.0+dfsg+~cs24.13.1-2ubuntu1vulnerable
Ubuntunodejs26.1024.18.0+dfsg+~cs24.13.2-1ubuntu1vulnerable
Ubuntunodejs26.1024.19.0+dfsg+~cs24.13.3-1ubuntu1vulnerable
Ubuntunodejs26.0420.19.4+dfsg-1vulnerable
Ubuntunodejs26.0420.19.5+dfsg+~cs20.19.12-4vulnerable
Ubuntunodejs26.0422.21.1+dfsg+~cs22.19.0-6ubuntu4vulnerable
Ubuntunodejs26.0422.22.0+dfsg+~cs22.19.6-1ubuntu2vulnerable
Ubuntunodejs26.0422.22.0+dfsg+~cs22.19.13-2ubuntu1vulnerable
Ubuntunodejs26.0422.22.1+dfsg+~cs22.19.15-1ubuntu1vulnerable
Alpinenodejs3.2122.23.4-r0fixed
Alpinenodejs3.2222.23.4-r0fixed
Alpinenodejs3.2324.22.1-r0fixed
Alpinenodejs3.2424.22.1-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannodejssourcesid24.22.1+dfsg+~cs24.19.2-1not yet assignedNot reported[1151688]
Debiannodejssourceforky(unfixed)not yet assignedNot reported[1151688]
Debiannodejssourcetrixie(unfixed)not yet assignedNot reported[1151688]
Debiannodejssourcebookworm(unfixed)not yet assignedNot reported[1151688]
Alpinenodejsapk3.2122.23.4-r0Not reportedALPINE-CVE-2026-106072Not reported
Alpinenodejsapk3.2222.23.4-r0Not reportedALPINE-CVE-2026-106072Not reported
Alpinenodejsapk3.2324.22.1-r0Not reportedALPINE-CVE-2026-106072Not reported
Alpinenodejsapk3.2424.22.1-r0Not reportedALPINE-CVE-2026-106072Not reported

[Debian bug #1151688]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libnode108]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [libnode-dev]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [nodejs]Affected
    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [nodejs-doc]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

[Debian 13 (Trixie)]

  • [libnode115]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

  • [libnode-dev]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

  • [nodejs]Affected
    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

  • [nodejs-doc]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · all · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · all · trixie-security

      Affected

      dsa · nodejs · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]