CVE-2026-48618: High severity OpenJS Foundation Node.js 22 vulnerability
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48618?
The severity of CVE-2026-48618 is high, with a score of 7.7.
What is CVE-2026-48618 about?
CVE-2026-48618 addresses a flaw in Node.js TLS hostname handling that may lead to authentication bypass.
How does CVE-2026-48618 affect Node.js?
CVE-2026-48618 affects Node.js versions 22, 24, and 26 through insecure handling of unicode dot separators in hostnames.
How do I fix CVE-2026-48618?
To fix CVE-2026-48618, you should upgrade to a patched version of Node.js as soon as possible.
What are the potential impacts of CVE-2026-48618?
The potential impacts of CVE-2026-48618 include confidentiality issues and bypassing of intended security boundaries.