ALPINE-CVE-2026-106072
- Source
- https://security.alpinelinux.org/vuln/CVE-2026-106072
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-106072.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-106072
- Upstream
- CVE-2026-106072
- Published
- 2026-10-23T17:17:20Z
- Modified
- 2026-10-24T09:30:02Z
- Severity
-
- 6.7 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
- Summary
- [none]
- Details
-
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as
0177.0.0.1,0x7f.0.0.1,2130706433or127.1.tls.checkServerIdentity()did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containingDNS:127.0.0.1and noIP Address:127.0.0.1SAN was therefore accepted, while the same certificate is correctly rejected for127.0.0.1. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- References
Affected packages
Alpine:v3.21 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:apk/alpine/nodejs?arch=source
Alpine:v3.22 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:apk/alpine/nodejs?arch=source
Alpine:v3.23 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:apk/alpine/nodejs?arch=source