HackerOne Disclosed Reports - 2026-10-23

Medium
resolved

Null Dereference in X509ToObject

Bug reported by Eunsoo Kim was disclosed at October 23, 2026, 10:30 pm   |   NULL Pointer Dereference

A null pointer dereference vulnerability was identified in X.509 certificate handling. The vulnerability could cause a process to crash when converting a specially crafted certificate to a JavaScript object. This vulnerability affected Node.js versions 24.x and 26.x.

Low
resolved

Permission Model bypass with fs.realpathSync

Bug reported by Sir bugs was disclosed at October 23, 2026, 5:38 pm   |   Improper Access Control - Generic

A flaw in the Permission Model filesystem enforcement left fs.realpathSync() without required read permission checks. This was an incomplete fix of a previous vulnerability that only covered fs.realpathSync.native(). Code running under permission restrictions with limited filesystem read access was able to use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

Medium
resolved

Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints

Bug reported by Alex Cantor was disclosed at October 23, 2026, 5:08 pm   |   Improper Certificate Validation

A flaw was discovered in TLS hostname verification that allowed certificates with only DNS Subject Alternative Names to authenticate IP endpoints when clients connected using non-canonical IPv4 address formats. The verification function failed to classify these alternate spellings as IP addresses and instead normalized them to their canonical form, matching them against certificate DNS names. This resulted in certificates containing numeric DNS entries being incorrectly accepted for IP endpoint authentication. The vulnerability affected multiple versions of a popular runtime environment.

High
resolved

TLS certificate hostname bypass when the IP is written fullwidth digits

Bug reported by HASAN FLAYYIH ABDULLAH was disclosed at October 23, 2026, 3:03 pm   |   Improper Certificate Validation

A flaw was discovered in TLS hostname verification that allowed a certificate without a matching IP address to authenticate connections when the host was written using non-ASCII characters. The verification function failed to recognize such hosts as IP addresses and instead matched them against certificate DNS names and Common Name. A certificate issued for one IP endpoint could be accepted for a different IP endpoint. This regression affected specific versions of the runtime.

Medium
resolved

Keep-alive socket process a response that was written before the request was sent

Bug reported by HASAN FLAYYIH ABDULLAH was disclosed at October 23, 2026, 3:03 pm   |   Time-of-check Time-of-use (TOCTOU) Race Condition

A flaw was discovered in HTTP Agent connection reuse where a client could accept a response that was sent before the request was transmitted. This occurred because the guard that destroys idle keep-alive sockets when unexpected data arrives only ran when the event loop polled for I/O. If an unsolicited response had already reached the socket but was not yet read when the socket was handed to a new request, the guard was removed without detecting the data, causing it to be parsed as the response to the new request. This vulnerability affected multiple versions of a runtime environment.

High
resolved

TLS certificate hostname bypass when the host loosely resolves to an IP address

Bug reported by anagnorisis2peripeteia was disclosed at October 23, 2026, 2:49 pm   |   Improper Certificate Validation

A flaw was discovered in TLS hostname verification that could allow a server certificate to be validated against a different IP address than the one the client connected to. This occurred when a host used a non-canonical IPv4 literal with a leading zero, as the certificate validation normalization followed different rules than the operating system resolver on some platforms. The vulnerability affected multiple versions of Node.js.

High
resolved

dns.resolve truncates names containing NUL char

Bug reported by HASAN FLAYYIH ABDULLAH was disclosed at October 23, 2026, 12:16 pm   |   Improper Access Control - Generic

A patch for CVE-2026-48930 was found to be incomplete. The fix rejected embedded NUL bytes in DNS lookup entry points but failed to apply the same validation to dns.resolve* entry points that interface with c-ares binding. When a NUL character was passed within a hostname to dns.resolve4(), the call did not throw an error and instead truncated the name at the NUL byte before querying the DNS server. This allowed a different hostname to be resolved than the one validated by the application, bypassing hostname validation checks in SSRF allowlists and DNS-rebinding guards. The vulnerability affected all dns.resolve* methods in both callback and promise APIs.