A flaw in Node.js’s TLS hostname handling causes a mismatch between resolver and verifier string normalization when Unicode dot separators are used. This produces a wildcard‑depth authentication bypass that may result in confidentiality impact or bypass of the intended security boundary under affected configurations. The weakness is categorized as CWE‑176 (unsafe string comparison) and CWE‑289 (improper normalization).

All currently supported Node.js releases are affected, including Node.js 22, 24, and 26. Any application running on these versions that establishes TLS connections and performs hostname verification is potentially vulnerable unless mitigated by a newer runtime.

The CVSS score of 7.7 indicates a high severity, while the EPSS score of 2% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The CVE description indicates that the flaw involves wildcard‑depth authentication bypass due to a mismatch in hostname normalization when Unicode dot separators are used in TLS connections. The vulnerability would affect applications that rely on TLS connections with wildcard certificates and process Unicode hostnames, though the exact attack conditions are not described in the CVE.