CVE-2026-48618 — nodejs / node

Description (CNA)

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Affected (CNA)

Vendor / product	Versions
nodejs / node	affected 22.22.3 through 22.22.3; affected 24.16.0 through 24.16.0; affected 26.3.0 through 26.3.0

CWE

CWE-176

References

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact.