CVE-2026-48930
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Risk Assessment
An attacker could exploit this vulnerability to bypass TLS security mechanisms, potentially leading to unauthorized access to resources or interception of communications.
Recommendation
It is recommended to immediately update Node.js to the latest patched version for the used release line (22, 24, or 26) and avoid using hostnames with embedded null characters in TLS configurations.
Other vulnerabilities in Node.js (wersje 22, 24, 26)
See all- CVE-2026-48928Medium
An inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
- CVE-2026-48615High
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.
Original NVD description (English source)
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS