Medium severity6.5NVD Advisory· Published Jun 26, 2026· Updated Aug 10, 2026
CVE-2026-48618
CVE-2026-48618
Description
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
28- osv-coords24 versionspkg:rpm/almalinux/nodejs24-npmpkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs26&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/v8-13.6-develpkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-full-i18npkg:bitnami/node-minpkg:rpm/almalinux/npmpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs-nodemonpkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs-npmpkg:bitnami/node
< 1:11.16.0-1.24.18.0.1.el10_2+ 23 more
- (no CPE)range: < 1:11.16.0-1.24.18.0.1.el10_2
- (no CPE)range: < 24.18.0-160000.1.1
- (no CPE)range: < 22.23.0-160000.1.1
- (no CPE)range: < 26.3.1-1.1
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: >= 22.22.3, < 22.23.0
- (no CPE)range: < 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 3.0.3-3.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 24.17.0-1.1
- (no CPE)range: < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:10.9.8-1.22.23.1.2.el10_2
- (no CPE)range: >= 22.22.3, < 22.23.0
Patches
Vulnerability mechanics
References
17- nodejs.org/en/blog/vulnerability/june-2026-security-releasesnvdPatchVendor Advisory
- access.redhat.com/errata/RHSA-2026:28727nvd
- access.redhat.com/errata/RHSA-2026:29012nvd
- access.redhat.com/errata/RHSA-2026:30172nvd
- access.redhat.com/errata/RHSA-2026:35841nvd
- access.redhat.com/errata/RHSA-2026:35842nvd
- access.redhat.com/errata/RHSA-2026:35891nvd
- access.redhat.com/errata/RHSA-2026:35892nvd
- access.redhat.com/errata/RHSA-2026:39246nvd
- access.redhat.com/errata/RHSA-2026:39868nvd
- access.redhat.com/errata/RHSA-2026:41947nvd
- access.redhat.com/errata/RHSA-2026:52399nvd
- access.redhat.com/errata/RHSA-2026:7378nvd
- access.redhat.com/errata/RHSA-2026:9455nvd
- access.redhat.com/security/cve/CVE-2026-48618nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.jsonnvd
News mentions
2- ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and MoreThe Hacker News · Jun 22, 2026
- Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication BypassesCyber Security News · Jun 19, 2026