CVE-2026-48930: A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c…
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
- Published by source
- 2026-06-26
- First seen by Reality Radar
- 2026-10-26
- Last verified
- 2026-10-26
Affected
- Manufacturer
- nodejs
- Products
- node.js
- Versions
- 22.22.3 24.16.0 26.3.0
- CPE
- cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*
Whether your exact unit is affected depends on the model, serial number and region in the official notice.
What the official notice says
Risk: critical severity (CVSS 9.8)
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-06-26
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1751 | new | 2026-10-26 | c1dcdd2d2d14…961217 | f3c3ceb808ba…996ef6 |
Chain head: #1771 9d8a5938d304…171807