From: Matteo Collina <hello@matteocollina.com>
Date: Mon, 20 Apr 2026 16:06:29 +0000 (+0200)
Subject: tls: fix case-sensitive SNI context matching
X-Git-Tag: archive/raspbian/18.20.4+dfsg-1_deb12u3+rpi1^2~11
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=b5b0f48c1a60e85784bb010d2d298ca54be6d7f8;p=nodejs.git

tls: fix case-sensitive SNI context matching

The regex constructed by server.addContext() lacked the case-insensitive
flag, causing uppercase or mixed-case SNI hostnames from ClientHello to
miss their intended context and fall back to the default context. This
violates RFC 6066 Section 3, which states that DNS hostnames are
case-insensitive. In mTLS configurations with per-tenant contexts, this
allowed bypassing client certificate authorization by simply
uppercasing the SNI hostname.

Add the 'i' flag to the RegExp in addContext() so that SNI matching
is case-insensitive.

PR-URL: https://github.com/nodejs-private/node-private/pull/857
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48928
Refs: https://hackerone.com/reports/3656869
origin: backport, https://github.com/nodejs/node/commit/39d1d0968471a144d93dc293d640008f57d3c58e

Gbp-Pq: Topic sec
Gbp-Pq: Name CVE-2026-48928.patch
---

diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index 1e4c69921..410de6c9e 100644
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -1593,10 +1593,11 @@ Server.prototype.addContext = function(servername, context) {
     throw new ERR_TLS_REQUIRED_SERVER_NAME();
   }
 
-  const re = new RegExp('^' + StringPrototypeReplaceAll(
-    RegExpPrototypeSymbolReplace(/([.^$+?\-\\[\]{}])/g, servername, '\\$1'),
-    '*', '[^.]*',
-  ) + '$');
+  const re = new RegExp(`^${
+    servername
+      .replace(/([.^$+?\-\\[\]{}])/g, '\\$1')
+      .replaceAll('*', '[^.]*')
+  }$`,'i');
 
   const secureContext =
     context instanceof common.SecureContext ? context : tls.createSecureContext(context);