CVE-2026-105483: Node.js TLS hostname check bypass with fullwidth-digit IP addresses

High 7.4 EPSS 0.3% Node.js

tls.checkServerIdentity() does not treat hosts written with non-ASCII digits (such as fullwidth １２７.0.0.1) as IP addresses, although they resolve to a normal IPv4 address, and matches them against certificate DNS names instead. A certificate containing DNS:127.0.0.1 or DNS:*.0.0.1 can then authenticate an IP endpoint it was not issued for. This regression from the CVE-2026-48618 fix affects only 24.x and 26.x; fixed October 21, 2026 (High, CVSS 7.4), no known exploitation.

• CVE-2026-105483CVE identifier
• 7.4CVSS 3.0 base score (high)
• 0.3%EPSS: chance of exploitation in the next 30 days (higher than 23% of CVEs)
• 2026-10-23published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Node.js 24.x up to 24.22.0
• Node.js 26.x up to 26.12.0
• Node.js 22.x is not affected

Fixed in:

• Node.js 24.22.1
• Node.js 26.12.1

Node.js lines affected: 24.x || 26.x; fixed in ^24.22.1 || ^26.12.1.

Am I affected?

node -v
dpkg -l nodejs 'libnode*' 2>/dev/null | grep ^ii      # Debian/Ubuntu
rpm -q nodejs nodejs22 nodejs24 2>/dev/null; dnf module list --enabled nodejs   # RHEL
apk info -v nodejs nodejs-current 2>/dev/null          # Alpine
docker run --rm <image> node -v                         # containers
pkg audit -F   # FreeBSD

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

# Debian's own nodejs packages (18.x bookworm, 20.x trixie) are not affected.
# If you run 24.x/26.x from NodeSource:
sudo apt update
sudo apt install --only-upgrade nodejs
node -v

# Ubuntu tracker: needs-triage (2026-11-03). Affected are 24.x/26.x builds, e.g. from NodeSource:
sudo apt update
sudo apt install --only-upgrade nodejs
node -v

sudo dnf module list --enabled nodejs        # RHEL 8/9: which stream is enabled
sudo dnf upgrade --refresh 'nodejs*'
node -v
# Stream with no fix (or EOL nodejs:20)? switch to a fixed stream, e.g. nodejs:24 on RHEL 8/9:
sudo dnf module reset -y nodejs && sudo dnf module enable -y nodejs:24 && sudo dnf distro-sync -y 'nodejs*'
# RHEL 10 ships nodejs22 / nodejs24 as normal packages: sudo dnf install nodejs24

sudo dnf upgrade --refresh nodejs22 nodejs24 (nodejsNN)

sudo zypper refresh
sudo zypper update nodejs22 nodejs24

sudo dnf upgrade --releasever=latest nodejs22 nodejs24 (nodejsNN)

sudo pacman -Syu

apk update
apk upgrade nodejs          # main repo (22.x on 3.22, 24.x on 3.23/3.24)
apk upgrade nodejs-current  # community repo, if installed (26.x on 3.24)
node -v

pkg update
pkg upgrade node24   # or node22 / node26 / node (meta port, currently 24)
pkg audit -F

# Move the FROM line to a fixed tag (or a moving major tag such as node:24-slim) and rebuild
#   FROM node:24.22.2-trixie-slim   (also: node:22.23.4-alpine, node:26.13.0-slim)
docker pull node:24.22.2-trixie-slim
docker build --pull -t myapp:patched .
docker run --rm myapp:patched node -v   # must be at least 24.22.1 / 26.12.1
docker compose up -d --force-recreate   # or redeploy / roll out the new image

# nvm: install the newest patch release of your line and make it the default
nvm install 24 --reinstall-packages-from=current   # or 22 / 26
nvm alias default 24
node -v   # must be at least 24.22.1 / 26.12.1
# Official binaries (Linux x64); verify the checksum before installing
VER=v24.22.2   # current fixed releases: v22.23.4, v24.22.2, v26.13.0
curl -fsSLO https://nodejs.org/dist/$VER/node-$VER-linux-x64.tar.xz
curl -fsSLO https://nodejs.org/dist/$VER/SHASUMS256.txt
grep " node-$VER-linux-x64.tar.xz\$" SHASUMS256.txt | sha256sum -c -
sudo tar -xJf node-$VER-linux-x64.tar.xz -C /usr/local --strip-components=1
/usr/local/bin/node -v

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Red Hat: do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits to TLS clients (tls.connect, https.request, fetch); restrict outbound TLS to trusted destinations.
• Node.js 20.x reached end-of-life on 2026-04-30 and 25.x on 2026-06-01; supported lines on 2026-11-03 are 22.x and 24.x (Maintenance LTS) and 26.x (Active LTS). End-of-life lines get no further fixes.

Related vulnerabilities

• CVE-2026-48618
• CVE-2026-106069
• CVE-2026-106072

Sources

• Node.js security releases, October 21, 2026
• CVE record CVE-2026-105483
• NVD: CVE-2026-105483
• GitHub advisory GHSA-8h4p-qpcq-gq24 (CVE-2026-105483)
• Debian security tracker: CVE-2026-105483
• Ubuntu CVE tracker: CVE-2026-105483
• Red Hat CVE page: CVE-2026-105483
• Alpine secdb (v3.22/v3.23/v3.24 main + community)
• FreeBSD VuXML 33a752ba-4cbe-46d8-abda-587011d90575 (Node.js, October 2026)
• Node.js release status (previous releases)
• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Page generated automatically from official sources on 2026-11-03 17:06 UTC and reviewed by an editor. Always confirm with your vendor's advisory.