CVE-2026-105483
Description
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence the connection target to impersonate a TLS server.
Statement
This issue is rated Important. Exploitation requires a Node.js TLS client to connect using a hostname that contains fullwidth Unicode digits which normalize to an IPv4 address, together with a certificate that satisfies the incorrect matching behavior. Attack Complexity is High because the attacker must influence the host string used for the connection (for example a user-supplied URL) and present a suitable certificate, typically with a privileged network position relative to that connection. Confidentiality and Integrity are High because a successful bypass enables server impersonation and exposure or alteration of TLS application data; Availability is not affected. This flaw affects Node.js 24.x and 26.x lines and does not affect the 22.x line per the upstream advisory.
Mitigation
To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | 7.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat CVSS v3 Score Explanation
AC:H: attacker must influence the TLS host string (e.g. untrusted URL with fullwidth digits) and present a certificate that matches the incorrect verification path, typically with a privileged network position. C/I:H for TLS server impersonation; A:N. Aligns with RH scoring for hostname-verification bypass (e.g. CVE-2026-66392). Rated Important (7.4).
Acknowledgements
Upstream acknowledges Hasan Flayyih Abdullah as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
