Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in Node.js. A regression in TLS IP hostname normalization allows a host written with fullwidth Unicode digits to bypass certificate hostname verification in checkServerIdentity. A TLS client can be made to accept a certificate that does not properly identify the requested IP address when connecting with such a hostname, enabling server impersonation.