Node.js TLS flaw CVE-2026-105483 lets certificates bind to IP endpoints wrongly; patch to 24.22.1 or 26.12.1

·3 views

A High-severity flaw, CVE-2026-105483, affects Node.js 24.x before 24.22.1 and 26.x before 26.12.1. During TLS verification, a fullwidth-digit IPv4 destination could be normalized to an address while DNS names were checked against the certificate. As a result, a trusted certificate with a matching DNS SAN but no IP SAN could authenticate an IP endpoint. Node.js released the fix on October 21, 2026, rating it CVSS v3.0 7.4 under CWE-295. The guidance recommends inventorying every Node.js process and executable that performs TLS, upgrading and rebuilding affected runtimes, and tightening destination validation and certificate identity checks as supporting mitigations. Teams are also advised to limit trusted certificate authorities and verify the fix with positive and negative TLS tests.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer weighs options for struggling X reply app Starling after weak early traction

A developer who built Starling, a tool that drafts X replies in the user's own voice, says the app has struggled to find users despite going live as a free beta on 31 October. After an unsuccessful Flippa auction that drew no bids, they are now considering selling the product, pivoting it toward professionals who reply online for work with a LinkedIn focus and a $19-29 monthly price, seeking an audience-holding partner, or shutting it down. Their estimate is that they may reach only 30-90 sign-ups and 0-2 paying users in the next two months, given the crowded market for AI writing tools. They have asked the developer community for advice and invited feedback on the free product at starlingwriter.com.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Confirmed Crypto Transactions Can Still Trigger AML Reviews

A blockchain transaction showing confirmation does not guarantee that the funds lack a suspicious history, a point often overlooked by users. Confirmation only shows the transfer was processed; it does not verify the origin of funds, sanctions exposure, or links to scams and stolen assets. Compliance screening instead examines the risk profile of a wallet address, which is a different question from whether a transaction occurred. Risk indicators can include sanctions connections, mixer activity, stolen funds, darknet exposure, and interactions with flagged counterparties. The concern is especially relevant for USDT on the TRON network, widely used by traders, exchanges, and businesses receiving stablecoin payments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DoorDash's AI-Assisted Coding Interview: A 60-Minute Practice Plan

DoorDash's March 2026 engineering interview announcement describes swapping traditional coding rounds for a 60-minute session where candidates use integrated AI tools on a supplied project. Evaluators reportedly weigh how candidates get oriented, verify AI output, debug, control scope, and explain tradeoffs, with finishing every task counting for less than good judgment. The article proposes a rehearsal built around a small support-ticket routing app, where a new refund rule must take priority over existing order and payment rules. The author stresses that the schedule is an original practice plan rather than DoorDash's official agenda, and advises candidates to confirm tool permissions with their recruiter.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FBI Attributes $6.3B Binance Crypto Theft to North Korea's TraderTraitor Group

The FBI has attributed the theft of roughly $6.3 billion in cryptocurrency from Binance on October 29, 2026, to the North Korean threat group TraderTraitor. Binance says it has found no evidence of hot-wallet private key leakage but is probing a possibly compromised DevOps endpoint and other potential entry points. TRM Labs reports that the stolen funds were moved across ten blockchains in a short window, using pre-signed authorizations on Ethereum and standard signed transfers elsewhere, which suggests the signing infrastructure was compromised. Frozen assets total about $2.7 billion as of October 30, but attackers still hold ETH and BTC that issuers cannot freeze. Binance plans to phase in withdrawal resumption starting November 1.

0 comments Read more at DEV Community