Node.js CVE-2026-106072

Affects Node.js TLS peers that validate server/peer certificates against IP addresses; exploitation requires an attacker able to intercept or interpose on the TLS connection and supply a certificate using a non-canonical IP representation that the unpatched validation logic accepted. The precise trigger is not described in the available sources. Limiting factors: the attacker needs an on-path/MITM position rather than a purely remote request, and the issue is fixed by upgrading to Node.js 26.12.1 (and the corresponding patched 24.x and 22.x releases); affected baselines per EUVD are Node 24.22.0 (≤24.22.0), 26.12.0 (≤26.12.0) and 22.23.3 (≤22.23.3).

This is a CWE-295 improper-certificate-validation flaw in Node.js TLS, grouped with CVE-2026-106069 under the fix 'tls: reject non-canonical IP addresses' and rated High by the Node.js project. Weighing the signals: it is NOT in CISA KEV (no confirmed active exploitation), and no EPSS score was supplied, so widespread-exploitation probability cannot be quantified. The multi-source feed shows only a PoC reference (a GitHub gist) that is not verified as working exploit code, and a vuln.today decision label of 'this_month' - meaningful but below act_now/emergency urgency. The input CVSS is 6.7 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L); note the PR:H and A:L are hard to reconcile with a certificate-validation/MITM weakness, which normally needs no privileges and does not primarily affect availability - treat that vector as suspect and verify with the Node.js advisory. Net: a genuine security fix worth patching this cycle for TLS-dependent Node deployments, but on current evidence it reads as a correctness/validation hardening issue rather than an actively-exploited emergency.

An attacker positioned to intercept a victim's TLS connection (e.g., on a shared network path) presents a certificate whose IP subject-alternative-name uses a non-canonical representation of the target address, which affected Node.js versions failed to reject, allowing the connection to validate against an attacker-controlled certificate. A public PoC reference (gist) exists but is not verified as working exploit code; the precise trigger is not described in the available sources.