CVE-2026-48618

Low

No strong exploitation signal.

CVSS base

6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — probability of exploitation (30 days)

3.2%

87.7th percentile

CISA KEV

Not listed

Weakness / dates

CWE-289

Published 2026-06-26 · modified 2026-08-10

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	L	Low
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	H	High
Integrity	N	None
Availability	N	None

Timeline

2026-06-26 — Published (NVD)
2026-08-10 — Last modified (NVD)

Description

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Affected

nodejs

References

Official: NVD · CVE.org