Tmeletlidis

**Name of the Vulnerable Software and Affected Versions** Node.js versions 22.x through 26.3.0 **Description** A flaw in TLS hostname handling occurs when Node.js processes unicode dot separators, leading to a mismatch between resolver and verifier hostname normalization. This discrepancy can result in a TLS wildcard-depth authentication bypass, potentially compromising confidentiality or bypassing intended security boundaries under affected configurations. **Recommendations** Update Node.js to version 26.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.0.0 through 26.3.0 **Description** An inconsistency in hostname matching can lead to a trust-policy bypass within multi-context mTLS (mutual Transport Layer Security) setups. mTLS is a process where both the client and server authenticate each other using digital certificates. **Recommendations** Update Node.js 22 to the latest patched version. Update Node.js 24 to the latest patched version. Update Node.js 26 to version 26.3.1-1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.x and earlier **Description** A flaw in TLS hostname handling allows embedded-nul hostnames to cause silent authority rebinding. This occurs due to c-string truncation in resolver bindings, where a null character in the hostname string terminates the string prematurely in the underlying C code, potentially leading the application to connect to an unintended destination. **Recommendations** Update Node.js 22 to the latest patched version. Update Node.js 24 to the latest patched version. Update Node.js 26 to version 26.3.1-1.1 or later.