Node.js EUVD-2026-109107

Exploitation requires an attacker-in-the-middle position on the TLS path and a peer identified/validated by IP address, where Node.js accepts a certificate presenting the IP in a non-canonical representation instead of rejecting it (CWE-295). Limiting factors: the CVSS vector sets AC:H, indicating non-trivial preconditions (notably the MITM position and a crafted certificate); no authentication or user interaction is required of the attacker per PR:N/UI:N. The precise feature/configuration that must be in use (e.g., IP-based certificate verification path) is implied by the fix but not spelled out in the available sources, so affected deployment modes beyond IP-identified TLS connections are unverified. Affected versions are Node 26.12.0, 24.22.0, and 22.23.3 and earlier on those branches; the vendor fix (26.12.1 and companion releases) is the remediation and updating is the stated path.

This is a TLS certificate-validation flaw (CWE-295) in Node.js fixed in the 2026-10-21 security releases. The vendor CVSS:3.0 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4 High) indicates a network-reachable issue needing no privileges or user interaction but with High attack complexity, consistent with a flaw that requires an attacker-in-the-middle position and a specially shaped certificate rather than a simple direct request. Exploitation status is 'no public exploit identified at time of analysis' for working code, but a public PoC reference exists (a gist); it is not verified as working exploit code, so POC availability must not be read as active exploitation. There is no EPSS score in the input and no CISA KEV listing, so there is no evidence of widespread or active exploitation; the vuln.today decision label is 'this_week', indicating prompt but non-emergency patching. The signals are internally consistent: High severity driven by confidentiality/integrity impact (MITM) rather than ease of exploitation, tempered by AC:H and no confirmed in-the-wild use. The AC:H in the input is a severity metric and is not explained by the available sources as any specific race or timing condition; the exact trigger mechanism beyond 'reject non-canonical IP addresses' is not described in the available sources. Net: a real priority for Node.js operators to patch this week, but not an emergency absent KEV/EPSS escalation.

An attacker positioned to intercept TLS traffic (e.g., on a shared or compromised network path) presents a certificate whose IP address is encoded in a non-canonical form that a vulnerable Node.js client fails to reject, allowing the attacker's endpoint to be accepted as the intended IP-identified peer. This enables interception and tampering of the TLS session (MITM). A public PoC reference exists; it is not verified as working exploit code, and the precise triggering steps are not described in the available sources.