Patch Forecast
Red warning
Act within 24 hours.

CVE-2026-48930

Node.js: access control flaw

Risk score
84/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.3%
Published
26 Jun 2026

Open in the live forecast Today's forecast

What to know

What it is
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames to lead to silent authority rebinding due to c-string truncation in resolver bindings. An attacker could exploit this to gain high-level privileges.
Affected
{'products': ['Node.js'], 'packages': [], 'versions': ['22', '24', '26']}
Fix
Check the linked advisory for the concrete fix, as it is not specified here.
Exploitation
No known exploitation

Story map

Story map: Node.jsTHE FLAWSTHE FIXCVE-2026-48930Access control flawCVSS 9.8 · EPSS 0%CVE-2026-111497Out-of-bounds write can leadto remote code executionCVSS 9.2 · EPSS 1%CVE-2026-48618Authentication bypassCVSS 6.5 · EPSS 3%CVE-2026-105482Access control flawCVSS 7.4 · EPSS 0%FixUpdate to the latest availableversion: 1.0.10 or 1.1.1 or 1.2.1Who is exposed{'product': 'Google Brotli','packages': ['1.0.3', '1.0.4','1.0.5', '1.0.6', '1.0.7', '1.0.8','1.0.9', '1.0.10', '1.1.0', '1.1.1','1.2.0', '1.2.1'], 'versions'…RED · ACT TODAYNode.jsA buffer overflow vulnerabilityin the Brotli decoder of GoogleBrotli versions 1.0.3 through1.2.0 allows a remoteunauthenticated attacker topotentially execute arbitrarycode or cause a denial of service.Where it standsExploitation reported in the press1 outlet covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.21 Oct · Node.js security releasesWednesday, October 21, 2026 Security Releases23 Oct · The Hacker NewsResearchers Demonstrate Node2Shell RCE Exploiton Node.js Build Using Crafted Brotli Data24 Oct · The Hacker NewsBrotli Decoder Flaw Behind Node.js RCE AlsoAffects Bun, Python and Other Widely UsedSoftwareCONNECTS TOSame weaknessAccess control flaw (CWE-284)324 other warnings in 30 days →Same productEarlier Node.js warnings11 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Node.js: Red, act today. A buffer overflow vulnerability in the Brotli decoder of Google Brotli versions 1.0.3 through 1.2.0 allows a remote unauthenticated attacker to potentially execute arbitrary code or cause a denial of service.

The flaws

The fix

Fix: Update to the latest available version: 1.0.10 or 1.1.1 or 1.2.1

Who is exposed: {'product': 'Google Brotli', 'packages': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1'], 'versions': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1']}

Where it stands

  • Exploitation reported in the press
  • 1 outlet covering it

How it unfolded

  1. 21 Oct, Node.js security releases (official): Wednesday, October 21, 2026 Security Releases
  2. 23 Oct, The Hacker News (press): Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
  3. 24 Oct, The Hacker News (press): Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Connects to

Why it is Red

  • CVSS 9.8 critical
  • Remotely exploitable without logging in
  • On your watchlist: node.js
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Last activity 21 Oct 2026. Patch Forecast updates every hour.