CVE-2026-48933

HIGH 7.5

CVSS Score

7.5

EPSS Score

2.8%

EPSS Percentile

85th

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CWE	CWE-190
Vendor	nodejs
Product	node
Ecosystems	JavaScript Node.js
Industries	Technology
Published	Jun 26, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for nodejs node

Be the first to know when new high vulnerabilities affecting nodejs node are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Versions

nodejs / node

22.22.3 ≤ 22.22.3 24.16.0 ≤ 24.16.0 26.3.0 ≤ 26.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗