A flaw in Node.js’s TLS hostname handling causes a mismatch between resolver and verifier string normalization when Unicode dot separators are used. This produces a wildcard‑depth authentication bypass that may result in confidentiality impact or bypass of the intended security boundary under affected configurations. The weakness is categorized as CWE‑176 (unsafe string comparison) and CWE‑289 (improper normalization).

All currently supported Node.js releases are affected, including Node.js 22, 24, and 26. Any application running on these versions that establishes TLS connections and performs hostname verification is potentially vulnerable unless mitigated by a newer runtime.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of 3% points to a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the CVE description, the flaw is a wildcard‑depth authentication bypass that arises from a mismatch in hostname normalization when Unicode dot separators are used in TLS connections. An attacker could potentially use this condition to authenticate to a TLS endpoint and intercept or tamper with data, thereby affecting confidentiality and the integrity of the communication channel.