Paper/Archive/CVE-2026-48930

CVE-2026-48930

nodejs node — A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncatio…

EPSS 0.3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 24.4.244 × 204.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Affected

ProductAffectedFixed inSource

node22.22.3 – 22.22.3–CNA

node24.16.0 – 24.16.0–CNA

node26.3.0 – 26.3.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

hackerone (CNA)5.6CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refnodejs.org/en/blog/vulnerability/june-2026-security-releases