Node.js EUVD-2026-109100

Exploitation requires that Node.js be performing TLS peer/certificate validation where the certificate identity is an IP address, and that the attacker can influence the certificate seen by the client/peer - in practice a man-in-the-middle or malicious-endpoint position on the network path. The affected feature is TLS certificate validation of IP addresses in Node.js 26.12.0 and 24.22.0, where an IP-normalization regression causes non-canonical IP representations to be mishandled. Limiting factors: the CVSS AC:H indicates non-trivial conditions (the attacker must achieve an interception position and supply a suitably crafted certificate), and the issue applies only to the two listed vulnerable releases; it does not grant code execution or affect availability (A:N). The exact trigger of the normalization regression is not described in the available sources beyond the release note 'tls: fix ip normalization regression'.

This is a genuine but not emergency-level priority. The CVSS 3.0 base score is 7.4 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, meaning network-reachable and unauthenticated, but with high attack complexity - the AC:H strongly implies the attacker needs a favorable position (typically a man-in-the-middle vantage) rather than being able to attack any Node.js process at will. The flaw is a TLS IP-normalization regression classified as CWE-295 (Improper Certificate Validation), so the C:H/I:H / A:N impact profile fits confidentiality and integrity loss of TLS-protected traffic rather than denial of service. The vuln.today Decision label is 'this_week', consistent with a High-severity issue that is not under confirmed active exploitation. Signals are partially missing or should be read with care: there is NO CISA KEV listing and NO EPSS score provided in the input, so widespread automated exploitation cannot be asserted; a PoC reference (a GitHub gist) is listed but is explicitly not verified as working exploit code. The product (Node.js) is ubiquitous, which raises aggregate exposure, but the AC:H requirement and absence of confirmed in-the-wild use mean this is a patch-promptly item rather than a drop-everything emergency. Note the limited precision of the source: the specific trigger for the normalization regression is not described in the available sources beyond the release-note line 'tls: fix ip normalization regression'.

An attacker positioned to intercept a TLS connection presents or crafts a server/peer certificate whose IP address is expressed in a non-canonical form; the IP-normalization regression causes Node.js to accept a certificate it should reject, letting the attacker impersonate the intended endpoint and read or alter the supposedly protected traffic. A public PoC reference (a gist) is listed but is not verified as working exploit code, so practical exploitation is plausible but not demonstrated from the available data.