WinMagic
Security Advisory
CVE-2026-106072 — Improper Certificate Validation for Non-Canonical IPv4 Subject Alternative Names
Reference: KB-SEC-2026-1028-08 | Published: October 28, 2026 | Status: Not Affected
Applies to: SecureDoc Client, SES Console, SESWeb (all versions)
Third-party component affected: Node.js | Severity: Medium
Executive summary
WinMagic is aware of CVE-2026-106072 (Improper Certificate Validation for Non-Canonical IPv4 Subject Alternative Names), a vulnerability affecting Node.js. WinMagic has reviewed this CVE against SecureDoc Client, the SES Console and SESWeb. None of these products is affected, for the reason given below. No remediation, patch, or configuration change is required in response to this CVE.
Vulnerability details
CVE ID | CVE-2026-106072 |
Title | Improper Certificate Validation for Non-Canonical IPv4 Subject Alternative Names |
Affected third-party component | Node.js |
Severity | Medium |
CVSS | Not published by the Node.js project as a numeric score; the Node.js security release and downstream advisories rate it Medium severity. |
Affected versions (upstream) | Node.js 26.x, 24.x, and 22.x lines prior to the October 2026 security release. |
What the vulnerability is
Node.js's TLS certificate validation accepts IPv4 addresses written in the subject alternative name (SAN) field in non-canonical forms, such as octal, hexadecimal, or mixed notation, rather than requiring the standard decimal dotted form.
Why you should pay attention
A certificate authority or validation layer that expects IPv4 addresses in SANs to be written in the standard form can have its scoping intentions bypassed if Node.js accepts equivalent but differently formatted addresses, allowing a certificate to authenticate an endpoint it was not clearly scoped to.
WinMagic product assessment
SecureDoc Client, SES Console, and SESWeb
SecureDoc does not include, install or depend on a Node.js runtime.
Conclusion: SecureDoc Client, the SES Console and SESWeb are not affected by CVE-2026-106072.
Remediation
No WinMagic product-specific remediation, software update, patch, or configuration change is required in response to CVE-2026-106072. Organizations that run Node.js elsewhere in their own environment, outside of WinMagic products, should apply that vendor's own patch according to their standard process.
Ongoing monitoring
WinMagic continues to monitor relevant security advisories and available information concerning CVE-2026-106072. Should new information materially change this assessment, WinMagic will review its potential impact on SecureDoc Client, the SES Console or SESWeb and update this article accordingly.
Questions about this advisory
Customers with questions about this assessment can contact WinMagic Support through the usual support channel referencing KB-SEC-2026-1028-08.
WinMagic Corp.
winmagic.com