Medium severity4.3NVD Advisory· Published Jun 26, 2026· Updated Jun 29, 2026
CVE-2026-48934
CVE-2026-48934
Description
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Affected products
28- osv-coords24 versionspkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/npmpkg:bitnami/node-minpkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs24-docspkg:rpm/opensuse/nodejs26&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:bitnami/nodepkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/v8-13.6-devel
< 2021.06-6.module_el9.7.0+209+ecf6523e+ 23 more
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 24.18.0-160000.1.1
- (no CPE)range: < 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
- (no CPE)range: >= 22.22.3, < 22.23.0
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 3.0.3-3.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 24.17.0-1.1
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 26.3.1-1.1
- (no CPE)range: < 22.23.0-160000.1.1
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:10.9.8-1.22.23.1.2.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: >= 22.22.3, < 22.23.0
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.1.el10_2
- (no CPE)range: < 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
Patches
Vulnerability mechanics
References
1- nodejs.org/en/blog/vulnerability/june-2026-security-releasesnvdPatchVendor Advisory
News mentions
2- Node.js: Four Permission Model & HTTPS Agent Flaws Patched in July 2026 BatchVypr Intelligence · Jul 31, 2026
- Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication BypassesCyber Security News · Jun 19, 2026