Medium severity · published Jun 26, 2026
CVE-2026-48618
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname…
6.5
CVSS
3.1%
EPSS
No
On KEV
Description
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
node · nodejs
22.22.3 through 22.22.3; 24.16.0 through 24.16.0; 26.3.0 through 26.3.0 · source: vendor
NO
Node.js · Nodejs
22.22.3; 24.16.0; 26.3.0 · source: NVD
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Hardened Images · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48618
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48618
Patch
https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:28727
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:29012
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:30172
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:35841
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:35842
More from node
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
8.4
CVE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries
8.2
CVE-2026-48617
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation
8.1
CVE-2024-27980
Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code…
8.1
CVE-2024-36138
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn /…