CVE-2016-7099

What it actually does

The tls.checkServerIdentity function fails to correctly validate wildcards in X.509 certificate name fields, permitting spoofed server identities during TLS handshakes.

Why it matters to the business

Organizations running affected Node.js versions face risk of encrypted traffic interception, which can expose sensitive data in transit and undermine trust in secure communications.

How an attack unfolds

An attacker intercepts network traffic to a Node.js application, supplies a crafted X.509 certificate containing a malicious wildcard pattern, and exploits the improper validation to impersonate a legitimate server and decrypt or modify the session.

How to fix it

Upgrade Node.js to 0.10.47, 0.12.16, 4.6.0, 6.7.0 or newer; apply the patch from commit 743f0c916469f3129dfae406fa104dc46782e20b in the nodejs/node repository.

How to confirm the fix worked

Confirm the installed Node.js version meets or exceeds the fixed releases and execute test cases that exercise wildcard certificate validation against known-good and malicious patterns.

Typical attack path

1. Position as a network intermediary to observe TLS connections
2. Generate a certificate with a wildcard that bypasses the flawed identity check
3. Present the certificate during the TLS handshake
4. Complete the connection as the spoofed server
5. Decrypt or manipulate application data in transit

How to detect it

Review application and TLS library logs for unexpected successful handshakes with non-standard certificate subjects; search network flow data for connections that bypass expected server identity checks.

What your security team should do

• Immediately update all Node.js deployments to the fixed versions listed in remediation guidance
• Audit TLS client code that relies on checkServerIdentity for any custom overrides
• Reissue or rotate any long-lived credentials transmitted over previously vulnerable connections