From b5b0f48c1a60e85784bb010d2d298ca54be6d7f8 Mon Sep 17 00:00:00 2001 From: Matteo Collina Date: Mon, 20 Apr 2026 18:06:29 +0200 Subject: [PATCH] tls: fix case-sensitive SNI context matching The regex constructed by server.addContext() lacked the case-insensitive flag, causing uppercase or mixed-case SNI hostnames from ClientHello to miss their intended context and fall back to the default context. This violates RFC 6066 Section 3, which states that DNS hostnames are case-insensitive. In mTLS configurations with per-tenant contexts, this allowed bypassing client certificate authorization by simply uppercasing the SNI hostname. Add the 'i' flag to the RegExp in addContext() so that SNI matching is case-insensitive. PR-URL: https://github.com/nodejs-private/node-private/pull/857 Reviewed-By: Antoine du Hamel CVE-ID: CVE-2026-48928 Refs: https://hackerone.com/reports/3656869 origin: backport, https://github.com/nodejs/node/commit/39d1d0968471a144d93dc293d640008f57d3c58e Gbp-Pq: Topic sec Gbp-Pq: Name CVE-2026-48928.patch --- lib/_tls_wrap.js | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js index 1e4c69921..410de6c9e 100644 --- a/lib/_tls_wrap.js +++ b/lib/_tls_wrap.js @@ -1593,10 +1593,11 @@ Server.prototype.addContext = function(servername, context) { throw new ERR_TLS_REQUIRED_SERVER_NAME(); } - const re = new RegExp('^' + StringPrototypeReplaceAll( - RegExpPrototypeSymbolReplace(/([.^$+?\-\\[\]{}])/g, servername, '\\$1'), - '*', '[^.]*', - ) + '$'); + const re = new RegExp(`^${ + servername + .replace(/([.^$+?\-\\[\]{}])/g, '\\$1') + .replaceAll('*', '[^.]*') + }$`,'i'); const secureContext = context instanceof common.SecureContext ? context : tls.createSecureContext(context); -- 2.39.5