Node.js TLS hostname verification logic incorrectly normalizes non‑canonical IPv4 literals that begin with a leading zero. When a client connects to an address such as 0127.0.0.1, the hostname is interpreted as octal by the TLS check, turning it into 87.0.0.1, while the operating system resolver treats the literal as decimal and connects to 127.0.0.1. The server’s certificate is then validated against the wrong IP, enabling an attacker to present a certificate issued for an unrelated address while the client believes it is authenticated. This flaw is a certificate trust validation weakness and an address parsing flaw (CWE‑295, CWE‑297) and permits a man‑in‑the‑middle or authentication‑bypass attack against any Node.js server that accepts such IP literals.

Node.js JavaScript runtime versions 26.x, 24.x, and 22.x are affected. The vulnerability applies to any Node.js application using the default TLS hostname verification hooks, specifically the tls.checkServerIdentity() function.

The flaw carries a CVSS score of 7.4, indicating a high severity. Although no EPSS score is available, the potential to bypass certificate verification without local code execution makes the target attractive for attackers. The vulnerability is not listed in the CISA KEV catalog, but its impact is independent of platform; it can be triggered on any system that resolves lead‑zero IP literals as decimal, including macOS and potentially other operating systems with similar resolver behavior.