CVE-2026-48618
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk45th percentile — higher than 45% of all known CVEs
Summary
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch.
Risk Assessment
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
Recommendation
It is recommended to immediately update Node.js to the latest patched version for lines 22, 24, and 26, and verify TLS configurations for wildcard usage.
Original NVD description (English source)
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.