CVE-2026-48618

HIGH 7.7

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CWE	CWE-176
Vendor	nodejs
Product	node
Ecosystems	JavaScript Node.js
Industries	Technology
Published	Jun 26, 2026
Last Updated	Jul 21, 2026

Stay Ahead of the Next One

Get instant alerts for nodejs node

Be the first to know when new high vulnerabilities affecting nodejs node are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected Versions

nodejs / node

22.22.3 ≤ 22.22.3 24.16.0 ≤ 24.16.0 26.3.0 ≤ 26.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗