A vulnerability in Node.js TLS certificate hostname validation allows a hostname that loosely resolves to an IP address to bypass hostname verification. This may enable an attacker to impersonate a trusted endpoint and potentially facilitate man-in-the-middle attacks.