High severity7.5NVD Advisory· Published Jun 26, 2026· Updated Aug 10, 2026
CVE-2026-48933
CVE-2026-48933
Description
A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a multiple of 2GiB.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
28- osv-coords24 versionspkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/v8-13.6-develpkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/npmpkg:rpm/almalinux/nodejs24-docspkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/nodejs-develpkg:rpm/opensuse/nodejs26&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs24-full-i18npkg:bitnami/nodepkg:bitnami/node-min
< 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47+ 23 more
- (no CPE)range: < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.1.el10_2
- (no CPE)range: < 24.17.0-1.1
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 3.0.3-3.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 24.18.0-160000.1.1
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 26.3.1-1.1
- (no CPE)range: < 22.23.0-160000.1.1
- (no CPE)range: < 1:10.9.8-1.22.23.1.2.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: >= 22.22.3, < 22.23.0
- (no CPE)range: >= 22.22.3, < 22.23.0
Patches
Vulnerability mechanics
References
17- nodejs.org/en/blog/vulnerability/june-2026-security-releasesnvdPatchVendor Advisory
- access.redhat.com/errata/RHSA-2026:28727nvd
- access.redhat.com/errata/RHSA-2026:29012nvd
- access.redhat.com/errata/RHSA-2026:30172nvd
- access.redhat.com/errata/RHSA-2026:35841nvd
- access.redhat.com/errata/RHSA-2026:35842nvd
- access.redhat.com/errata/RHSA-2026:35891nvd
- access.redhat.com/errata/RHSA-2026:35892nvd
- access.redhat.com/errata/RHSA-2026:39246nvd
- access.redhat.com/errata/RHSA-2026:39868nvd
- access.redhat.com/errata/RHSA-2026:41947nvd
- access.redhat.com/errata/RHSA-2026:52399nvd
- access.redhat.com/errata/RHSA-2026:7378nvd
- access.redhat.com/errata/RHSA-2026:9455nvd
- access.redhat.com/security/cve/CVE-2026-48933nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48933.jsonnvd
News mentions
2- ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and MoreThe Hacker News · Jun 22, 2026
- Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication BypassesCyber Security News · Jun 19, 2026