CVE-2026-48618
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 3.2%
exploitation probability
3.2%top 12% of all CVEs
observed exploitation
nono source reports it
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
nodejs · nodeReferences
https://access.redhat.com/errata/RHSA-2026:28727https://access.redhat.com/errata/RHSA-2026:29012https://access.redhat.com/errata/RHSA-2026:30172https://access.redhat.com/errata/RHSA-2026:35841https://access.redhat.com/errata/RHSA-2026:35842https://access.redhat.com/errata/RHSA-2026:35891https://access.redhat.com/errata/RHSA-2026:35892https://access.redhat.com/errata/RHSA-2026:39246https://access.redhat.com/errata/RHSA-2026:39868https://access.redhat.com/errata/RHSA-2026:41947https://access.redhat.com/errata/RHSA-2026:52399https://access.redhat.com/errata/RHSA-2026:7378