CVE-2026-106069

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...

EUVD-2026-109107

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...

CVE-2026-106069

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...

CVE-2026-106069

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...

CVE-2026-106069

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...

CVE-2026-106069

A flaw in the Node.js TLS hostname verification allows an attacker to bypass security by presenting a certificate for an endpoint that does not belong to them. The tls.checkServerIdentity() function incorrectly normalizes non-canonical IPv4 literals with leading zeros (e.g., 0127.0.0.1) as octal,...

Node.js: TLS certificate hostname bypass when the host loosely resolves to an IP address

A flaw was discovered in TLS hostname verification that could allow a server certificate to be validated against a different IP address than the one the client connected to. This occurred when a host used a non-canonical IPv4 literal with a leading zero, as the certificate validation normalizatio...

PT-2014-5419

Name of the Vulnerable Software and Affected Versions cURL versions prior to 7.38.0 libcurl versions prior to 7.38.0 Description The issue allows remote attackers to set cookies for or send arbitrary cookies to certain sites by not properly handling IP addresses in cookie domain names. This can b...