WinMagic
Security Advisory
CVE-2026-105483 — TLS Hostname Verification Bypass via Fullwidth-Digit IP Address
Reference: KB-SEC-2026-1028-04 | Published: October 28, 2026 | Status: Not Affected
Applies to: SecureDoc Client, SES Console, SESWeb (all versions)
Third-party component affected: Node.js | Severity: High
Executive summary
WinMagic is aware of CVE-2026-105483 (TLS Hostname Verification Bypass via Fullwidth-Digit IP Address), a vulnerability affecting Node.js. WinMagic has reviewed this CVE against SecureDoc Client, the SES Console and SESWeb. None of these products is affected, for the reason given below. No remediation, patch, or configuration change is required in response to this CVE.
Vulnerability details
CVE ID | CVE-2026-105483 |
Title | TLS Hostname Verification Bypass via Fullwidth-Digit IP Address |
Affected third-party component | Node.js |
Severity | High |
CVSS | Not published by the Node.js project as a numeric score; the Node.js security release and downstream advisories rate it High severity. |
Affected versions (upstream) | Node.js 26.x and 24.x lines prior to the October 2026 security release (26.12.1, 24.22.1). |
What the vulnerability is
Node.js's TLS hostname verification treats fullwidth Unicode digit characters (U+FF10 through U+FF19) differently from their ASCII equivalents when comparing a certificate's subject alternative name against an IP address. This inconsistency lets a certificate issued for one IP address validate successfully against a different, attacker-chosen IP address.
Why you should pay attention
TLS hostname verification exists to stop exactly this kind of substitution: proving that the certificate presented actually belongs to the server being connected to. A bypass here can let an attacker position a server that presents a certificate for an IP address it doesn't control and have Node.js accept it anyway, undermining server identity checks in any Node.js application that validates certificates against IP addresses rather than DNS names.
WinMagic product assessment
SecureDoc Client, SES Console, and SESWeb
SecureDoc does not include, install or depend on a Node.js runtime.
Conclusion: SecureDoc Client, the SES Console and SESWeb are not affected by CVE-2026-105483.
Remediation
No WinMagic product-specific remediation, software update, patch, or configuration change is required in response to CVE-2026-105483. Organizations that run Node.js elsewhere in their own environment, outside of WinMagic products, should apply that vendor's own patch according to their standard process.
Ongoing monitoring
WinMagic continues to monitor relevant security advisories and available information concerning CVE-2026-105483. Should new information materially change this assessment, WinMagic will review its potential impact on SecureDoc Client, the SES Console or SESWeb and update this article accordingly.
Questions about this advisory
Customers with questions about this assessment can contact WinMagic Support through the usual support channel referencing KB-SEC-2026-1028-04.
WinMagic Corp.
winmagic.com