VYPR
Published Oct 23, 2026· Updated Oct 26, 2026· 1 source

Node.js: Nine Vulnerabilities in TLS, DNS, and Crypto Disclosed Together

Key findings • Nine Node.js vulnerabilities disclosed on October 23, 2026, including three high-severity flaws. • Flaws impact TLS hostname verification, DNS resolution, filesystem permission…

Key findings

  • Nine Node.js vulnerabilities disclosed on October 23, 2026, including three high-severity flaws.
  • Flaws impact TLS hostname verification, DNS resolution, filesystem permissions, and crypto functions.
  • Multiple vulnerabilities are related to incomplete fixes for previously disclosed security issues.
  • Patched versions include Node.js 22.23.4, 24.22.1, and 26.12.1.
  • End-of-life Node.js versions (20.x and earlier) are not fixed and require migration.

On October 23, 2026, Node.js released security updates addressing a batch of nine vulnerabilities disclosed on the same day. These flaws span several components of the Node.js runtime, including TLS hostname verification, DNS resolution, filesystem permissions, HTTP agent connection reuse, and the zlib API. The most severe issues carry a high severity rating, impacting critical security functions.

Several vulnerabilities relate to Node.js's TLS hostname verification. CVE-2026-106072 and CVE-2026-105483 detail flaws where certificates could be improperly validated against IP addresses. CVE-2026-106072 specifically addresses scenarios where a certificate with only a DNS SAN might authenticate an IP endpoint when non-canonical IPv4 spellings are used. CVE-2026-105483 highlights an issue where certificates lacking a matching IP address SAN could authenticate connections to IPv4 addresses if non-ASCII characters, such as fullwidth digits, were used in the hostname. A related high-severity flaw, CVE-2026-106069, also affects TLS hostname verification, allowing a server certificate to be validated against an incorrect IP address when non-canonical IPv4 literals with leading zeros are employed.

Further impacting network security, CVE-2026-105482 addresses a high-severity vulnerability in Node.js DNS resolution. This flaw allows hostnames containing a NUL byte to be silently truncated by dns.resolve*() functions and dns.reverse(), an incomplete fix from a previous CVE.

The batch also includes vulnerabilities related to Node.js's permission model and filesystem enforcement. CVE-2026-106073, a medium-severity issue, indicates that fs.realpathSync() lacks required read permission checks, allowing access to files even under restricted --allow-fs-read settings. This is an incomplete fix for a prior vulnerability. Similarly, CVE-2026-106071, a low-severity flaw, describes how the permission model can grant access to paths that do not precisely match wildcard --allow-fs-read or --allow-fs-write rules due to early termination in radix tree lookups.

Other vulnerabilities include CVE-2026-106074, a medium-severity issue in the crypto module where internal entropy caches can be saved into user-land startup snapshots and single executable applications. CVE-2026-105481, a medium-severity flaw in the HTTP Agent's connection reuse mechanism, could lead to a client accepting a response sent before the request was made, stemming from an incomplete fix of a previous CVE. Lastly, CVE-2026-106070, a low-severity issue in the zlib.ZipFile API, may return incorrect bytes after header validation fails.

These vulnerabilities were patched in Node.js versions 22.23.4, 24.22.1, and 26.12.1. Users are strongly advised to update to these versions to mitigate the risks associated with these security flaws. Older Node.js versions (20.x and earlier) have reached end-of-life and will not receive these fixes, necessitating migration to a supported release line.

The disclosure of these nine vulnerabilities together highlights ongoing security challenges within Node.js, particularly concerning network protocol handling and permission management. Users should prioritize updating their Node.js installations to ensure the security and integrity of their applications. The batch includes multiple high-severity flaws, underscoring the importance of prompt patching.

Key findings from this disclosure include:

  • Three high-severity vulnerabilities in TLS hostname verification and DNS resolution.
  • Two vulnerabilities related to incomplete fixes for previous Node.js security issues.
  • Flaws affecting critical components like crypto, HTTP, and zlib.
  • Patches available in Node.js 22.23.4, 24.22.1, and 26.12.1.
  • Older Node.js versions (20.x and below) are no longer supported and require migration.
Synthesized by Vypr AI