CVE-2026-48930

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nodejs.org/en/blog/vulnerability/june-2026-security-releases	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nodejs:node.js:22.22.3::::-:::
	cpe:2.3:a:nodejs:node.js:24.16.0::::-:::
	cpe:2.3:a:nodejs:node.js:26.3.0::::-:::

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Un fallo en el manejo de nombres de host TLS de Node.js puede causar que los nombres de host con nulo incrustado puedan llevar a una revinculación silenciosa de autoridad debido al truncamiento de cadena C en las vinculaciones del resolvedor. Esta vulnerabilidad afecta a todas las líneas de lanzamiento compatibles: Node.js 22, Node.js 24 y Node.js 26.

Information

Published : 2026-06-26 02:16

Updated : 2026-10-25 22:10

NVD link : CVE-2026-48930

Mitre link : CVE-2026-48930

CVE.ORG link : CVE-2026-48930

JSON object : View

Products Affected

nodejs

node.js

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-48930", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48930", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T13:37:29.781800Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.2}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "nodejs", "product": "node", "versions": [{"status": "affected", "version": "22.22.3", "versionType": "semver", "lessThanOrEqual": "22.22.3"}, {"status": "affected", "version": "24.16.0", "versionType": "semver", "lessThanOrEqual": "24.16.0"}, {"status": "affected", "version": "26.3.0", "versionType": "semver", "lessThanOrEqual": "26.3.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-26T02:16:52.723", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "tags": ["Patch", "Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."}, {"lang": "es", "value": "Un fallo en el manejo de nombres de host TLS de Node.js puede causar que los nombres de host con nulo incrustado puedan llevar a una revinculaci\u00f3n silenciosa de autoridad debido al truncamiento de cadena C en las vinculaciones del resolvedor.\n\nEsta vulnerabilidad afecta a todas las l\u00edneas de lanzamiento compatibles: Node.js 22, Node.js 24 y Node.js 26."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "3C0C5080-5F99-4651-9855-2DE03C9070C5"}, {"criteria": "cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "3B912C84-1AA5-4D74-AB1A-64162C80A33B"}, {"criteria": "cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "8152ACE6-3CAF-4CA0-8B19-D4753811EB44"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}