CVE Feed

    Dashboard / CVE / CVE-2026-48618

    CVE-2026-48618

    A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    Published:Jun 26, 2026
    Last Modified:Jun 26, 2026
    EPS:Jun 26, 2026
    EPSS Score:0.00609
    CVSS Score:7.7

    Affected Products

    Vendor
    Nodejs
    Product
    Nodejs
    Vendor
    Redhat
    Product
    Hummingbird

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-71 Using Unicode Encoding to Bypass Validation Logic

    Related CVEs

    CVE-2026-48932 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …
    CVE-2026-56848 (CVSS 7.5) — A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2…
    CVE-2026-58042 (CVSS 5.9) — A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than…
    CVE-2026-58044 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …
    CVE-2026-58045 (CVSS 6.2) — A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchrono…
    CVE-2026-58041 (CVSS 5.3) — A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore…
    CVE-2026-56846 (CVSS 7.5) — A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable re…
    CVE-2026-58039 (CVSS 3.3) — A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --a…
    CVE-2026-56847 (CVSS 6.1) — A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Log…
    CVE-2026-56850 (CVSS 4.4) — A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS …

    References

    https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
    https://access.redhat.com/errata/RHSA-2026:28727
    https://access.redhat.com/errata/RHSA-2026:29012
    https://access.redhat.com/errata/RHSA-2026:30172
    https://access.redhat.com/errata/RHSA-2026:35841
    https://access.redhat.com/errata/RHSA-2026:35842
    https://access.redhat.com/errata/RHSA-2026:35891
    https://access.redhat.com/errata/RHSA-2026:35892
    https://access.redhat.com/errata/RHSA-2026:39246
    https://access.redhat.com/errata/RHSA-2026:39868
    https://access.redhat.com/errata/RHSA-2026:41947
    https://access.redhat.com/errata/RHSA-2026:52399
    https://access.redhat.com/errata/RHSA-2026:7378
    https://access.redhat.com/errata/RHSA-2026:9455
    https://access.redhat.com/security/cve/CVE-2026-48618
    https://bugzilla.redhat.com/show_bug.cgi?id=2493337
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High