CVE-2016-7099: Node.js

Medium severity, CVSS 5.9. EPSS: 2.8% chance of exploitation in the next 30 days.

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Affected products

• Node.js Node.js: version 0.10.0 only; version 0.10.1 only; version 0.10.2 only; version 0.10.3 only; version 0.10.4 only; version 0.10.5 only; …
• Suse Linux Enterprise: version 12.0 only

Published 2016-10-10. Last modified 2026-06-17.