Executive brief
A vulnerability in Node.js could allow an attacker to crash applications that use the WebCrypto API for data encryption. By providing a specific amount of data (multiples of 2GiB) to the encryption function, the application process may terminate unexpectedly. This results in a denial-of-service, potentially disrupting business operations and service availability.
Technical details
An integer overflow vulnerability (CWE-190) exists in the Node.js WebCrypto AES implementation. The flaw is triggered when the `subtle.encrypt()` function processes input data that is a multiple of 2GiB, leading to a remote process abort. This is a denial-of-service (DoS) vector that does not require authentication or user interaction if the application accepts large encrypted payloads from the network. The issue affects Node.js versions 22, 24, and 26. Patches were released in June 2026 (v22.23.0, v24.17.0, and v26.3.1).
Affected products
- Node.js Node.js 22.x, 24.x, 26.x
Timeline
- 2026-06-18: patched: Security releases v22.23.0, v24.17.0, and v26.3.1 made available.
- 2026-06-26: disclosed: CVE-2026-48933 published.