Node.js performs TLS hostname verification by normalizing host names before comparing them with the certificate’s subject alternative names (SANs). In this flaw, the function treats non‑canonical IPv4 representations—such as "0177.0.0.1", "0x7f.0.0.1", or "2130706433"—as IP addresses, normalizes them to a canonical form, and then matches that form only against DNS SANs. If a certificate contains a DNS SAN like "127.0.0.1" but no corresponding IP SAN, a TLS connection to an IP endpoint can be authenticated successfully, effectively bypassing certificate validation. This flaw permits an attacker to pretend to be the intended server and perform man‑in‑the‑middle or impersonation attacks, compromising confidentiality and integrity of encrypted traffic.

The vulnerability affects the Node.js runtime for the 26.x, 24.x, 22.x release lines. The issue resides in the internal TLS implementation of these Node.js versions and can affect any application that relies on Node.js to establish secure outbound connections.

The CVSS score of 6.7 indicates a moderate severity. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a high‑profile or actively exploited vulnerability at this time. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client and a DNS resolver that accepts the non‑canonical IPv4 spellings, such as those provided by glibc. Because of these prerequisites, the attack surface is limited, but the impact of successful exploitation—TLS impersonation—can be significant for applications that assume strict hostname validation.