Post by @q3k@social.hackerspace.pl

q3k :blobcatcoffee:

@q3k@social.hackerspace.pl 18 min. ago

> TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high)

what a week

0 Boosts

0 Likes

q3k :blobcatcoffee:

@q3k@social.hackerspace.pl 13 min. ago

ctf web 300 ass vuln

Haelwenn /элвэн/ :triskell:

@lanodan@queer.hacktivis.me 16 min. ago

@q3k "404 Not Found"
Not published yet?

q3k :blobcatcoffee:

@q3k@social.hackerspace.pl 14 min. ago

@lanodan https://nodejs.org/ja/blog/vulnerability/october-2026-security-releases

Node.js — Wednesday, October 21, 2026 Security Releases

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

lina isidora

@lina@tech.lgbt 17 min. ago

@q3k fullwidth as in the cjk fullwidth latin? why would it even accept that in the first place..

dmiException 🎃

@domi@donotsta.re 12 min. ago

@lina @q3k because JS normalizes CJK latin to normal ASCII in a couple places, for compat reasons

it baffles me that this leads to a cert bypass, but…

Haelwenn /элвэн/ :triskell:

@lanodan@queer.hacktivis.me 4 min. ago

@domi @q3k @lina Reminds me of the CVEs uutils (Rewrite-in-Rust of coreutils) got in April, due to also messing with character encodings for things that need to be treated as raw bytes.
(For example: CVE-2026-35346 CVE-2026-35366 CVE-2026-35373 CVE-2026-35375)