CVE-2026-48618
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.7
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- EPSS probability
- 3.23%
- CWE
- CWE-176
- Published
- 2026-06-26
- Last modified
- 2026-08-10
Affected products
- nodejs node
- nodejs node
- nodejs node
Weakness type
Related vulnerabilities
- CVE-2026-14978 — Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
- CVE-2026-59890 — setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
- CVE-2026-45135 — Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- CVE-2026-49401 — Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
- CVE-2026-45062 — FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
- CVE-2025-71316 — SQLite sqldiff remote code execution via argument injection
- CVE-2026-44288 — protobufjs: Overlong UTF-8 decoding
- CVE-2026-7040 — Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 characters