Summary
Different Unicode hostname normalization in DNS resolution and TLS certificate verification could allow a wildcard certificate to match a deeper hostname than intended. The issue affected Node.js 22, 24 and 26 and was fixed in the June 18, 2026 security releases.
Technical analysis
The accompanying research article explains the finding, reproduction, and remediation status.
Read the technical write-upDisclosure timeline
- Public disclosure
Credits
Reported by tmeletlidis; fixed by Matteo Collina, as credited in Node.js's security release.