CVE-2026-106069

A flaw in the Node.js TLS hostname verification allows an attacker to bypass security by presenting a certificate for an endpoint that does not belong to them. The tls.checkServerIdentity() function incorrectly normalizes non-canonical IPv4 literals with leading zeros (e.g., 0127.0.0.1) as octal,...