Vulnerability · Published Jun 26, 2026 · Assigned by hackerone

CVE-2026-48618

High 7.7

In plain English

A high-severity security flaw in node from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)3.1%top 12.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:10	nodejs	1:22.23.1-2.el10_2	ALSA-2026:35842
AlmaLinux:8	nodejs	1:22.23.1-1.module_el8.10.0+4231+1bf2f855	ALSA-2026:41947
AlmaLinux:8	nodejs	1:24.18.0-1.module_el8.10.0+4228+2938bc94	ALSA-2026:39868
AlmaLinux:9	nodejs	1:22.23.1-1.module_el9.8.0+276+8b329b47	ALSA-2026:35892
AlmaLinux:9	nodejs	1:24.18.0-1.module_el9.8.0+277+61fc613e	ALSA-2026:35891
AlmaLinux:10	nodejs-devel	1:22.23.1-2.el10_2	ALSA-2026:35842
AlmaLinux:8	nodejs-devel	1:24.18.0-1.module_el8.10.0+4228+2938bc94	ALSA-2026:39868
AlmaLinux:8	nodejs-devel	1:22.23.1-1.module_el8.10.0+4231+1bf2f855	ALSA-2026:41947
AlmaLinux:9	nodejs-devel	1:22.23.1-1.module_el9.8.0+276+8b329b47	ALSA-2026:35892
AlmaLinux:9	nodejs-devel	1:24.18.0-1.module_el9.8.0+277+61fc613e	ALSA-2026:35891
AlmaLinux:10	nodejs-docs	1:22.23.1-2.el10_2	ALSA-2026:35842
AlmaLinux:8	nodejs-docs	1:22.23.1-1.module_el8.10.0+4231+1bf2f855	ALSA-2026:41947
AlmaLinux:8	nodejs-docs	1:24.18.0-1.module_el8.10.0+4228+2938bc94	ALSA-2026:39868
AlmaLinux:9	nodejs-docs	1:24.18.0-1.module_el9.8.0+277+61fc613e	ALSA-2026:35891
AlmaLinux:9	nodejs-docs	1:22.23.1-1.module_el9.8.0+276+8b329b47	ALSA-2026:35892
AlmaLinux:10	nodejs-full-i18n	1:22.23.1-2.el10_2	ALSA-2026:35842
AlmaLinux:8	nodejs-full-i18n	1:22.23.1-1.module_el8.10.0+4231+1bf2f855	ALSA-2026:41947
AlmaLinux:8	nodejs-full-i18n	1:24.18.0-1.module_el8.10.0+4228+2938bc94	ALSA-2026:39868
AlmaLinux:9	nodejs-full-i18n	1:22.23.1-1.module_el9.8.0+276+8b329b47	ALSA-2026:35892
AlmaLinux:9	nodejs-full-i18n	1:24.18.0-1.module_el9.8.0+277+61fc613e	ALSA-2026:35891
AlmaLinux:10	nodejs-libs	1:22.23.1-2.el10_2	ALSA-2026:35842
AlmaLinux:8	nodejs-libs	1:24.18.0-1.module_el8.10.0+4228+2938bc94	ALSA-2026:39868
AlmaLinux:8	nodejs-libs	1:22.23.1-1.module_el8.10.0+4231+1bf2f855	ALSA-2026:41947
AlmaLinux:9	nodejs-libs	1:24.18.0-1.module_el9.8.0+277+61fc613e	ALSA-2026:35891
AlmaLinux:9	nodejs-libs	1:22.23.1-1.module_el9.8.0+276+8b329b47	ALSA-2026:35892
AlmaLinux:8	nodejs-nodemon	3.0.1-1.module_el8.10.0+3956+47c9ee9f	ALSA-2026:41947
AlmaLinux:8	nodejs-nodemon	3.0.3-1.module_el8.10.0+4061+f8ceeab9	ALSA-2026:39868
AlmaLinux:9	nodejs-nodemon	3.0.1-1.module_el9.7.0+208+fb06c0ab	ALSA-2026:35892
AlmaLinux:9	nodejs-nodemon	3.0.3-3.module_el9.7.0+209+ecf6523e	ALSA-2026:35891
AlmaLinux:10	nodejs-npm	1:10.9.8-1.22.23.1.2.el10_2	ALSA-2026:35842
AlmaLinux:8	nodejs-packaging	2021.06-6.module_el8.10.0+4158+e796f37f	ALSA-2026:41947
AlmaLinux:8	nodejs-packaging	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:39868
AlmaLinux:9	nodejs-packaging	2021.06-6.module_el9.7.0+209+ecf6523e	ALSA-2026:35891
AlmaLinux:9	nodejs-packaging	2021.06-6.module_el9.7.0+227+12323393	ALSA-2026:35892
AlmaLinux:8	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:39868
AlmaLinux:8	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4158+e796f37f	ALSA-2026:41947
AlmaLinux:9	nodejs-packaging-bundler	2021.06-6.module_el9.7.0+209+ecf6523e	ALSA-2026:35891
AlmaLinux:9	nodejs-packaging-bundler	2021.06-6.module_el9.7.0+227+12323393	ALSA-2026:35892
AlmaLinux:10	nodejs24	1:24.18.0-1.el10_2	ALSA-2026:35841
AlmaLinux:10	nodejs24-devel	1:24.18.0-1.el10_2	ALSA-2026:35841
AlmaLinux:10	nodejs24-docs	1:24.18.0-1.el10_2	ALSA-2026:35841
AlmaLinux:10	nodejs24-full-i18n	1:24.18.0-1.el10_2	ALSA-2026:35841
AlmaLinux:10	nodejs24-libs	1:24.18.0-1.el10_2	ALSA-2026:35841
AlmaLinux:10	nodejs24-npm	1:11.16.0-1.24.18.0.1.el10_2	ALSA-2026:35841
AlmaLinux:8	npm	1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94	ALSA-2026:39868
AlmaLinux:8	npm	1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855	ALSA-2026:41947
AlmaLinux:9	npm	1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47	ALSA-2026:35892
AlmaLinux:9	npm	1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e	ALSA-2026:35891
AlmaLinux:8	v8-12.4-devel	3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855	ALSA-2026:41947
AlmaLinux:9	v8-12.4-devel	3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47	ALSA-2026:35892
AlmaLinux:8	v8-13.6-devel	3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94	ALSA-2026:39868
AlmaLinux:9	v8-13.6-devel	3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e	ALSA-2026:35891
Alpine:v3.21	nodejs	22.23.0-r0	ALPINE-CVE-2026-48618
Alpine:v3.22	nodejs	22.23.0-r0	ALPINE-CVE-2026-48618
Alpine:v3.23	nodejs	24.17.0-r0	ALPINE-CVE-2026-48618
Alpine:v3.24	nodejs	24.17.0-r0	ALPINE-CVE-2026-48618
Debian:12	nodejs	18.20.4+dfsg-1~deb12u3	DEBIAN-CVE-2026-48618
Debian:13	nodejs	20.19.2+dfsg-1+deb13u3	DEBIAN-CVE-2026-48618
Debian:14	nodejs	24.17.0+dfsg+~cs24.13.2-1	DEBIAN-CVE-2026-48618
Rocky Linux:8	nodejs	1:24.18.0-1.module+el8.10.0+40252+a58646bc	RLSA-2026:39868
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1935+d3cbe60f	RLSA-2026:41947
Rocky Linux:8	nodejs-nodemon	0:3.0.3-1.module+el8.10.0+2084+ab509703	RLSA-2026:39868
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.9.0+1760+903d54b9	RLSA-2026:41947
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1667+4a788d89	RLSA-2026:41947
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1824+532140ee	RLSA-2026:41947
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1823+b5789597	RLSA-2026:41947
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1924+614dc87f	RLSA-2026:41947
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1666+930e28e8	RLSA-2026:41947
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1988+437f3d23	RLSA-2026:41947
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1989+e60144d9	RLSA-2026:41947
Rocky Linux:9	nodejs-nodemon	0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2	RLSA-2026:35891
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40022+9ecc286c	RLSA-2026:35892
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40165+d075e3f2	RLSA-2026:35892
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40153+4d595597	RLSA-2026:35892
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40171+8fa9c325	RLSA-2026:39868
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40172+38f6fdd1	RLSA-2026:39868
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:41947
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40171+8fa9c325	RLSA-2026:41947
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40172+38f6fdd1	RLSA-2026:41947
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:39868
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40153+4d595597	RLSA-2026:35891
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40165+d075e3f2	RLSA-2026:35891
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:35891
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40165+d075e3f2	RLSA-2026:35892
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:35892
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40153+4d595597	RLSA-2026:35892
Rocky Linux:10	nodejs22	1:22.23.1-2.el10_2	RLSA-2026:35842
Rocky Linux:10	nodejs24	1:24.18.0-1.el10_2	RLSA-2026:35841
Ubuntu:24.04:LTS	nodejs	no fix listed	UBUNTU-CVE-2026-48618
Ubuntu:25.10	nodejs	no fix listed	UBUNTU-CVE-2026-48618
Ubuntu:26.04:LTS	nodejs	no fix listed	UBUNTU-CVE-2026-48618
Ubuntu:26.10	nodejs	no fix listed	UBUNTU-CVE-2026-48618

Affected products (as reported)

Vendor	Product	Versions
nodejs	node	22.22.3 – through 22.22.324.16.0 – through 24.16.026.3.0 – through 26.3.0

Weakness: CWE-176, CWE-289 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
https://access.redhat.com/security/cve/CVE-2026-48618 vdb-entry, x_refsource_REDHAT
RHBZ#2493337 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:39246 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35842 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35841 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41947 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39868 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52399 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35892 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35891 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9455 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28727 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29012 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7378 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30172 vendor-advisory, x_refsource_REDHAT