CVE-2026-105483

Katalog CVE

CVSS 7.4 · High

Kerentanan Improper Certificate Validation. Skor CVSS 3.0 7.4 (High) menurut hackerone.com.

Deskripsi (NVD)

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Rilis Keamanan Node.js Oktober 2026, Celah Brotli CVE-2026-111497 Berpotensi Eksekusi Kode Jarak Jauh 24 Okt 2026

Rincian

Terbit di NVD

23 Oktober 2026

Terakhir diubah

23 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.0

7.4 (High), sumber hackerone.com
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases