CVE Intelligence
Analysis AI-assisted

CVE-2026-48930: Node.js TLS hostname handling flaw enabling silent authority rebinding

NVD and the CNA describe a Node.js flaw in TLS hostname handling, where hostnames with an embedded NUL byte can be truncated in resolver bindings and lead to silent authority rebinding. NVD rates it critical with CVSS 3.1 score 9.8, and the record lists Node.js 22, 24 and 26 release lines as affected. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a flaw in Node.js TLS hostname handling. Hostnames containing an embedded NUL byte can be truncated at the C-string level in resolver bindings, which the description links to silent authority rebinding. The weakness is mapped to CWE-284 (Improper Access Control).

Impact

  • NVD scores the issue 9.8 (critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The CNA support@hackerone.com lists a 5.6 score under CVSS 3.0. The record does not explain the difference.
  • The practical effect on a given deployment depends on how the application relies on TLS hostname verification. The record does not detail this.

Affected products and versions

  • The record lists Nodejs Node.js with the version strings 22.22.3, 24.16.0 and 26.3.0 as affected.
  • The description states that all supported release lines, Node.js 22, 24 and 26, are affected.
  • The record does not explicitly state which versions contain the fix. The vendor security release page is the reference to consult.

Exploitation status

No confirmed exploitation appears in the sources consulted. The record shows CISA KEV as not listed, and EPSS and SSVC data are absent.

Remediation and mitigation

  • Review the vendor June 2026 security release notes and update Node.js to the patched release for each release line in use.
  • Inventory every place Node.js runs, including container images and embedded runtimes, since the description covers all supported lines.
  • Until patching is complete, review which application logic makes trust decisions based on hostnames supplied from untrusted sources.

Detection guidance

  • Track Node.js versions across hosts and flag any instance matching the listed affected versions.
  • Review TLS connection logs and application errors for unexpected hostname or certificate mismatches. The record provides no specific indicators.

Limitations of the available information

  • The record gives no explicit list of fixed versions, no technical details of the code path, and no exploit information.
  • EPSS and SSVC are absent, and no CVSS 4.0 data is present.
  • The difference between the NVD and CNA CVSS scores is not explained.

Frequently asked questions

What is the core problem in CVE-2026-48930?

Node.js TLS hostname handling can truncate hostnames that contain an embedded NUL byte inside resolver bindings, which the record links to silent authority rebinding. The record classifies the weakness as CWE-284, Improper Access Control.

Is CVE-2026-48930 being actively exploited?

No confirmed exploitation appears in the sources consulted. The record shows the vulnerability is not listed in CISA KEV, and no EPSS or SSVC data is present.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.