The official CVE record is not published yet
Listed from the vendor advisory. It will be replaced with the CVE.org / NVD record once published.
Medium
Pre-CVE record
Node.js: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints
CVE-2026-106072
First seen on SecPulse
Summary
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Original description The description as published by the source.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Fixed in: Node.js v22.23.4, v24.22.1, v26.12.1
Source: Node.js Security Releases NVD