Executive brief
Node.js is a popular runtime environment used to build and run server-side applications. A security flaw in how it handles website addresses (hostnames) during secure connections could allow an attacker to bypass security checks. This could lead to unauthorized access to sensitive data or a breach of intended security boundaries in affected applications.
Technical details
A vulnerability exists in Node.js TLS hostname handling due to an improper handling of Unicode encoding (CWE-176). Specifically, a mismatch between how the resolver and the verifier normalize hostnames containing Unicode dot separators allows for a tls wildcard-depth authentication bypass. An attacker can exploit this normalization inconsistency to bypass intended security boundaries or gain unauthorized access to confidential information. The issue affects all supported release lines (22, 24, and 26) and has been addressed in security updates released in June 2026.
Affected products
- Node.js Node.js 22.x, 24.x, 26.x
Timeline
- 2026-06-18: patched: Security releases available for Node.js 22, 24, and 26.
- 2026-06-25: disclosed: CVE published to NVD.