{
  "id": 17674962,
  "title": "CVE-2026-105483 remediation checklist for Node.js teams",
  "url": "https://urgent.news/2026/11/01/cve-2026-105483-remediation-checklist-for-node-js-teams",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-01T20:40:14.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/kozhevniko/cve-2026-105483-remediation-checklist-for-nodejs-teams-818"
  },
  "original_language": "en",
  "account": null,
  "summary": "The CVE-2026-105483 vulnerability affects Node.js versions 24.x before 24.22.1 and 26.x before 26.12.1. The issue arises during TLS verification when a fullwidth-digit IPv4 destination is normalized and resolved as an address, while DNS names are checked against the certificate. A trusted certificate with a matching DNS SAN can authenticate an IP endpoint without an IP SAN. To remediate this vulnerability, Node.js teams should identify the running runtime, upgrade to the latest patched versions, review clients that accept destinations from tenants or users, narrow destination input to approved ASCII DNS names or canonical IP literals, and review trust anchors to limit client trust to required authorities. This remediation checklist is divided into two parts: mandatory runtime fixes and application hardening and assurance work.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}