# CVE-2016-7099: Node.js 4: The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before…

CVE-2016-7099 is fixed in Node.js 4 on 1 platform by Node.js 4 4.6.0 (version 4.6.0), released September 27, 2016. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2016-7099
- Priority: Routine
- CVSS: 5.9
- EPSS: 0.0284
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 10, 2016
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2016-7099

## Description

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 4 | 4.6.0 | [Node.js 4 4.6.0](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.4-4.6.0.md) | Sep 27, 2016 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo