CVE-2026-48618
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 3.2%
probabilidade de exploração
3.2%top 12% das CVEs
exploração observada
nãonenhuma fonte reporta
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
nodejs · nodeReferências
https://access.redhat.com/errata/RHSA-2026:28727https://access.redhat.com/errata/RHSA-2026:29012https://access.redhat.com/errata/RHSA-2026:30172https://access.redhat.com/errata/RHSA-2026:35841https://access.redhat.com/errata/RHSA-2026:35842https://access.redhat.com/errata/RHSA-2026:35891https://access.redhat.com/errata/RHSA-2026:35892https://access.redhat.com/errata/RHSA-2026:39246https://access.redhat.com/errata/RHSA-2026:39868https://access.redhat.com/errata/RHSA-2026:41947https://access.redhat.com/errata/RHSA-2026:52399https://access.redhat.com/errata/RHSA-2026:7378