FreeBSD : Node.js -- multiple vulnerabilities (33a752ba-4cbe-46d8-abda-587011d90575)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 33a752ba-4cbe-46d8-abda-587011d90575 advisory. Node.js reports: dns.resolve truncates names containing NUL char CVE-2026-105482 - high TLS...

Node.js: CVE-2026-105483: TLS certificate hostname verification bypass for IPv4 addresses written with fullwidth digits

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...

Vaadin and the October 2026 Node.js security releases

A deployed Vaadin application does not run Node.js, so it is not exposed to the vulnerabilities fixed in the Node.js security releases of 21 October 2026. Vaadin uses Node.js only to build the frontend and to run development mode, which means the exposure, where there is any, is in build and...

Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 Multiple Vulnerabilities

The version of Node.js installed on the remote host is 22.x prior to 22.23.4, 24.x prior to 24.22.1, or 26.x prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory. - An out-of-bounds write in the Brotli...

Node.js 24.x < 24.22.1 / 26.x < 26.12.1 TLS Certificate Hostname Bypass

The version of Node.js installed on the remote host is 24.x prior to 24.22.1 or 26.x prior to 26.12.1. It is, therefore, affected by a TLS certificate hostname bypass vulnerability as referenced in the Wednesday, October 21, 2026 Security Releases advisory. - TLS certificate hostname verification...

Node.js -- multiple vulnerabilities

Node.js reports: dns.resolve truncates names containing NUL char CVE-2026-105482 - high TLS certificate hostname bypass when the IP is written fullwidth digits CVE-2026-105483 - high TLS certificate hostname bypass when the host loosely resolves to an IP address CVE-2026-106069 - high Node.js...

EUVD-2026-97571

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service...

PT-2026-110811

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 12.x prior to 12.1.0 Progress MarkLogic Server versions 11.x prior to 11.3.7 Description Certain outbound connections do not consistently validate TLS certificate hostnames. This allows a network-positioned...

Node.js: TLS certificate hostname bypass when the IP is written fullwidth digits

A flaw was discovered in TLS hostname verification that allowed a certificate without a matching IP address to authenticate connections when the host was written using non-ASCII characters. The verification function failed to recognize such hosts as IP addresses and instead matched them against...

Node.js: TLS certificate hostname bypass when the host loosely resolves to an IP address

A flaw was discovered in TLS hostname verification that could allow a server certificate to be validated against a different IP address than the one the client connected to. This occurred when a host used a non-canonical IPv4 literal with a leading zero, as the certificate validation normalizatio...

CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...