CVE-2026-48618
Estado: ModificadaMedia (6.5)—
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 3.23%
- Percentil entre todas las CVEs puntuadas: 88
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-176
- CWE-289
Referencias
- https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
- https://access.redhat.com/errata/RHSA-2026:28727
- https://access.redhat.com/errata/RHSA-2026:29012
- https://access.redhat.com/errata/RHSA-2026:30172
- https://access.redhat.com/errata/RHSA-2026:35841
- https://access.redhat.com/errata/RHSA-2026:35842
- https://access.redhat.com/errata/RHSA-2026:35891
- https://access.redhat.com/errata/RHSA-2026:35892
- https://access.redhat.com/errata/RHSA-2026:39246
- https://access.redhat.com/errata/RHSA-2026:39868
- https://access.redhat.com/errata/RHSA-2026:41947
- https://access.redhat.com/errata/RHSA-2026:52399
- https://access.redhat.com/errata/RHSA-2026:7378
- https://access.redhat.com/errata/RHSA-2026:9455
- https://access.redhat.com/security/cve/CVE-2026-48618
- https://bugzilla.redhat.com/show_bug.cgi?id=2493337
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-48618",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48618",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-06-26T15:10:27.583362Z"
}
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "support@hackerone.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 7.7,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 4,
"exploitabilityScore": 3.1
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
},
{
"type": "Secondary",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 7.7,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 4,
"exploitabilityScore": 3.1
}
]
},
"affected": [
{
"source": "support@hackerone.com",
"affectedData": [
{
"vendor": "nodejs",
"product": "node",
"versions": [
{
"status": "affected",
"version": "22.22.3",
"versionType": "semver",
"lessThanOrEqual": "22.22.3"
},
{
"status": "affected",
"version": "24.16.0",
"versionType": "semver",
"lessThanOrEqual": "24.16.0"
},
{
"status": "affected",
"version": "26.3.0",
"versionType": "semver",
"lessThanOrEqual": "26.3.0"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "1:24.18.0-1.el10_2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs24",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "1:22.23.1-2.el10_2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs22",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:22.23.1-2.el10_0",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs22",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "8100020260630152626.6d880403",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs:24",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "8100020260703140402.6d880403",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs:22",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "9080020260626074955.rhel9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs:24",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "9080020260626075442.rhel9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs:22",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"versions": [
{
"status": "unaffected",
"version": "22.23.1-1.hum1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs22-main",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"versions": [
{
"status": "unaffected",
"version": "24.18.0-0.1.hum1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs24-main",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"versions": [
{
"status": "unaffected",
"version": "26.4.0-1.2.hum1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs26-main",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"versions": [
{
"status": "unaffected",
"version": "25.9.0-1.1.hum1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs25-main",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"versions": [
{
"status": "unaffected",
"version": "20.20.2-1.hum1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "nodejs20-main",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
}
]
}
],
"published": "2026-06-26T02:16:52.397",
"references": [
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:28727",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:29012",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30172",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:35841",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:35842",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:35891",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:35892",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39246",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39868",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:41947",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:52399",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:7378",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:9455",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-48618",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "support@hackerone.com",
"description": [
{
"lang": "en",
"value": "CWE-176"
}
]
},
{
"type": "Secondary",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"description": [
{
"lang": "en",
"value": "CWE-289"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\r\n\r\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
}
],
"lastModified": "2026-08-10T13:19:45.207",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C0C5080-5F99-4651-9855-2DE03C9070C5"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B912C84-1AA5-4D74-AB1A-64162C80A33B"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8152ACE6-3CAF-4CA0-8B19-D4753811EB44"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "support@hackerone.com"
}