← Vulnerability feed

Vulnerability record · CVE-2026-48618 · published 26 June 2026

CVE-2026-48618: Nodejs node.js vulnerability

Nodejs · Node.Js

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

6.5 CVSS 3.1 Medium EPSS 3.2% · top 12.2% CWE-176 · CWE-176CWE-289 · CWE-289
6.5CVSS 3.1 base score
3.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
17References
10 Aug 2026Last modified by NVD

Description

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://nodejs.org/en/blog/vulnerability/june-2026-security-releases PatchVendor Advisory
https://access.redhat.com/errata/RHSA-2026:28727
https://access.redhat.com/errata/RHSA-2026:29012
https://access.redhat.com/errata/RHSA-2026:30172
https://access.redhat.com/errata/RHSA-2026:35841
https://access.redhat.com/errata/RHSA-2026:35842
https://access.redhat.com/errata/RHSA-2026:35891
https://access.redhat.com/errata/RHSA-2026:35892
https://access.redhat.com/errata/RHSA-2026:39246
https://access.redhat.com/errata/RHSA-2026:39868
https://access.redhat.com/errata/RHSA-2026:41947
https://access.redhat.com/errata/RHSA-2026:52399
https://access.redhat.com/errata/RHSA-2026:7378
https://access.redhat.com/errata/RHSA-2026:9455
https://access.redhat.com/security/cve/CVE-2026-48618
https://bugzilla.redhat.com/show_bug.cgi?id=2493337
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json

Track CVE-2026-48618 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed10.0CVE-2026-21636Nodejs node.js improper access control vulnerabilityA flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even …EPSS 0.88%10.0CVE-2015-0278Fedoraproject fedora vulnerabilitylibuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.EPSS 3.2%9.8CVE-2026-48930Nodejs node.js improper access control vulnerabilityA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolve…EPSS 0.32%9.8CVE-2024-3566Haskell process library command injection vulnerabilityA command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess fu…EPSS 6.9%9.8CVE-2024-21896Nodejs node.js vulnerabilityThe permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be tr…EPSS 1.3%9.8CVE-2023-39332Nodejs node.js path traversal vulnerabilityVarious `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the…EPSS 1.8%9.8CVE-2023-32002Nodejs node.js authentication bypass via alternate path vulnerabilityThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulner…EPSS 1.6%

Source: NIST National Vulnerability Database (record CVE-2026-48618), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.