{
  "cveId": "CVE-2016-7099",
  "url": "https://patchblox.com/security/cve/CVE-2016-7099",
  "summary": "CVE-2016-7099 is fixed in Node.js 4 on 1 platform by Node.js 4 4.6.0 (version 4.6.0), released September 27, 2016. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Node.js 4: The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before\u2026",
  "description": "The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.",
  "published": "2016-10-10T16:59:01Z",
  "severity": "",
  "cvss": 5.9,
  "epss": 0.02841,
  "epssPercentile": 0.86739,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2016-7099",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Node.js 4",
      "fixedVersion": "4.6.0",
      "fix": "Node.js 4 4.6.0",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.4-4.6.0",
      "released": "2016-09-27T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T06:34:28Z"
}