CVE-2026-48930

Published: Jun 26, 2026Modified: Jun 26, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Affected (3)

Products: Nodejs: Node.js

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	Version 22.22.3
Nodejs Node.js	Version 24.16.0
Nodejs Node.js	Version 26.3.0

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (1)

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Source: support@hackerone.com

PatchVendor Advisory

Timeline

No history available yet.