Testing the fullwidth-IPv4 certificate path in CVE-2026-105483
Testing the fullwidth-IPv4 certificate path in CVE-2026-105483 A regression test for CVE-2026-105483 should prove that an address remains an address throughout destination parsing and certificate validation. Affected Node.js 24.x and 26.x releases could normalize and resolve a fullwidth-digit IPv4 host while tls.checkServerIdentity() compared the peer certificate against DNS names. A certificate…
The article discusses a regression test for CVE-2026-105483, a vulnerability in Node.js 24.x and 26.x versions that could allow a fullwidth-digit IPv4 host to be normalized and resolved, causing a TLS certificate to be authenticated against a DNS name without a matching IP SAN. The issue is rated High, with a CVSS v3.0 score of 7.4 and CWE-295.
To test the vulnerability, a private test CA and a local TLS endpoint should be set up, with a certificate containing only a DNS SAN containing the canonical address, such as 127.0.0.1. The test should assert rejection and the error class, not just a timeout failure. The test should also include controls for certificates with correct IP address SANs and DNS SANs for normal names.
The affected Node.js versions are 24.x before 24.22.1 and 26.x before 26.12.1, while the 22.x line is not listed as affected. The article also suggests adding tests for hostile input forms and verifying the deployed artifact's runtime version and image digest.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
