Node.js accepted the wrong certificate for six spellings of one address
2026-11-03Security
The October release fixed ten CVEs. Three are TLS hostname bypasses, between them naming six non-canonical ways to write 127.0.0.1, and four of the ten say an earlier fix did not hold.