tls: fix case-sensitive SNI context matching

The regex constructed by server.addContext() lacked the case-insensitive
flag, causing uppercase or mixed-case SNI hostnames from ClientHello to
miss their intended context and fall back to the default context. This
violates RFC 6066 Section 3, which states that DNS hostnames are
case-insensitive. In mTLS configurations with per-tenant contexts, this
allowed bypassing client certificate authorization by simply
uppercasing the SNI hostname.

Add the 'i' flag to the RegExp in addContext() so that SNI matching
is case-insensitive.

PR-URL: https://github.com/nodejs-private/node-private/pull/857
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48928
Refs: https://hackerone.com/reports/3656869
origin: backport, https://github.com/nodejs/node/commit/39d1d0968471a144d93dc293d640008f57d3c58e

Gbp-Pq: Topic sec
Gbp-Pq: Name CVE-2026-48928.patch

diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index 1e4c6992149534a7118c704a6e67b26eaaa65297..410de6c9e2d7fbe1c9d09e1f9cc664fd52bae920 100644 (file)
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -1593,10 +1593,11 @@ Server.prototype.addContext = function(servername, context) {
     throw new ERR_TLS_REQUIRED_SERVER_NAME();
   }
 
-  const re = new RegExp('^' + StringPrototypeReplaceAll(
-    RegExpPrototypeSymbolReplace(/([.^$+?\-\\[\]{}])/g, servername, '\\$1'),
-    '*', '[^.]*',
-  ) + '$');
+  const re = new RegExp(`^${
+    servername
+      .replace(/([.^$+?\-\\[\]{}])/g, '\\$1')
+      .replaceAll('*', '[^.]*')
+  }$`,'i');
 
   const secureContext =
     context instanceof common.SecureContext ? context : tls.createSecureContext(context);