CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN…
- Risk score
- 67/100
- CVSS
- 7.4 v3.0
- Exploit chance (30 days)
- 0.2%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters. An attacker could use a malicious certificate to authenticate a connection to an IP endpoint it was not issued for.
- Affected
- {'products': ['Node.js'], 'packages': [], 'versions': ['26.x', '24.x']}
- Fix
- Check the linked advisory for the fix, as the record does not specify a concrete action.
- Exploitation
- No known exploitation
Story map
At a glance
Node.js: Red, act today. A buffer overflow vulnerability in the Brotli decoder of Google Brotli versions 1.0.3 through 1.2.0 allows a remote unauthenticated attacker to potentially execute arbitrary code or cause a denial of service.
The flaws
- CVE-2026-105483: A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN… (CVSS 7.4 · EPSS 0%)
- CVE-2026-111497: Out-of-bounds write can lead to remote code execution (CVSS 9.2 · EPSS 1%)
- CVE-2026-48930: Access control flaw (CVSS 9.8 · EPSS 0%)
- CVE-2026-48618: Authentication bypass (CVSS 6.5 · EPSS 3%)
The fix
Fix: Update to the latest available version: 1.0.10 or 1.1.1 or 1.2.1
Who is exposed: {'product': 'Google Brotli', 'packages': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1'], 'versions': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1']}
Where it stands
- Exploitation reported in the press
- 1 outlet covering it
How it unfolded
- 21 Oct, Node.js security releases (official): Wednesday, October 21, 2026 Security Releases
- 23 Oct, The Hacker News (press): Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
- 24 Oct, The Hacker News (press): Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
- 25 Oct, Microsoft Security Response Center (official): CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
Connects to
- Same weakness: CWE-295 (CWE-295). 84 other warnings in 30 days
- Same product: Earlier Node.js warnings. 11 in the last 90 days
Why it is Amber
- CVSS 7.4 high
- Remotely exploitable without logging in
- On your watchlist: node.js
- Named in a government or vendor bulletin
Government and vendor bulletins
References
Original description
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**.
Last activity 23 Oct 2026. Patch Forecast updates every hour.