CVE-2026-48618
Node.js: authentication bypass
- Risk score
- 72/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 3.2%
- Published
- 26 Jun 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw in Node.js TLS hostname handling can cause a wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatches, leading to confidentiality impact or bypass of the intended security boundary.
- Affected
- {'products': ['Node.js'], 'packages': [], 'versions': ['22', '24', '26']}
- Fix
- Check the linked advisory for the concrete fix
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 6.5 medium
- On your watchlist: node.js
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
- https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
- https://access.redhat.com/errata/RHSA-2026:28727
- https://access.redhat.com/errata/RHSA-2026:29012
- https://access.redhat.com/errata/RHSA-2026:30172
- https://access.redhat.com/errata/RHSA-2026:35841
- https://access.redhat.com/errata/RHSA-2026:35842
- https://access.redhat.com/errata/RHSA-2026:35891
- https://access.redhat.com/errata/RHSA-2026:35892
- https://access.redhat.com/errata/RHSA-2026:39246
Original description
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Last activity 21 Oct 2026. Patch Forecast updates every hour.