Executive brief
A security flaw in Node.js affects how the platform handles secure network connections (TLS). An attacker could potentially use specially crafted hostnames to trick the system into connecting to a different server than intended. This could lead to unauthorized data access or the bypass of security boundaries in applications that rely on these hostname checks.
Technical details
A vulnerability exists in Node.js TLS hostname handling where hostnames containing embedded null characters (NUL) are improperly processed. Due to C-string truncation in the resolver bindings, the hostname may be interpreted differently by different parts of the system, leading to silent authority rebinding. This allows an attacker to potentially bypass security boundaries or redirect traffic. The issue affects Node.js versions 22, 24, and 26, and has been addressed in security releases v22.23.0, v24.17.0, and v26.3.1.
Affected products
- Node.js Node.js 22.x, 24.x, 26.x
Timeline
- 2026-06-18: patched: Security releases v22.23.0, v24.17.0, and v26.3.1 made available.
- 2026-06-26: disclosed: CVE-2026-48930 published.