CVE-2026-48933: Integer Overflow
A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a multiple of 2GiB.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48933?
CVE-2026-48933 has a severity rating of high with a score of 7.5.
How does CVE-2026-48933 impact Node.js applications?
CVE-2026-48933 can cause the Node.js process to crash when `subtle.encrypt()` is called with input sizes of 2GiB or larger.
Which versions of Node.js are affected by CVE-2026-48933?
CVE-2026-48933 affects Node.js version 22, 24, and 26.
How can I mitigate CVE-2026-48933?
To mitigate CVE-2026-48933, avoid using input sizes for `subtle.encrypt()` that are 2GiB or larger.
What type of vulnerability is CVE-2026-48933 classified as?
CVE-2026-48933 is classified as an integer overflow vulnerability.