A flaw in Node.js’s TLS hostname handling causes a mismatch between resolver and verifier string normalization when Unicode dot separators are used. This produces a wildcard‑depth authentication bypass that can allow an attacker to impersonate a legitimate client and obtain confidential information. The weakness is categorized as CWE‑176 (unsafe string comparison) and CWE‑289 (improper normalization).

All currently supported Node.js releases are affected, including Node.js 22, 24, and 26. Any application running on these versions that establishes TLS connections and performs hostname verification is potentially vulnerable unless mitigated by a newer runtime.

The CVSS score of 7.7 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote network‑based exploitation where an attacker crafts a specially encoded hostname that satisfies a wildcard certificate, causing the server to accept an unauthorized connection. The attack requires the target to use TLS connections that rely on wildcard certificate matching and process Unicode hostnames.