TLS Server Identity Spoofing Vulnerability
CVE-2016-7099 · MEDIUM Severity
AV:N/AC:M/AU:N/C:N/I:P/A:N
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Learn more about our Cis Benchmark Audit For Server Software.