CVE-2026-105483

Name	CVE-2026-105483
Description	A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js 26.x* and 24.x.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151688, 1151859

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nodejs (PTS)	bookworm	18.20.4+dfsg-1~deb12u2	fixed
	bookworm (security)	18.20.4+dfsg-1~deb12u3	fixed
	trixie	20.19.2+dfsg-1+deb13u2	fixed
	trixie (security)	20.19.2+dfsg-1+deb13u3	fixed
	forky, sid	24.22.2+dfsg+~cs24.19.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
nodejs	source	bookworm	(not affected)
nodejs	source	trixie	(not affected)
nodejs	source	(unstable)	24.22.1+dfsg+~cs24.19.2-1	1151688, 1151859

Notes

[trixie] - nodejs <not-affected> (vulnerable code introduced later)
[bookworm] - nodejs <not-affected> (vulnerable code introduced later)
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-ip-is-written-fullwidth-digits-cve-2026-105483---high
Regression of CVE-2026-48618 on node24 and node26 not present before