Vulnerability Report

CVE-2026-48618

Title: Node.js TLS Wildcard-Depth Authentication Bypass

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-48618.

CWE Category CWE-176

Published Date Jun 26, 2026

Modified Date Jul 21, 2026

Exploit Status Not Found

Score 6.5 CVSS v3.0

Exploit Probability (EPSS)

2.49%

Vulnerability Summary

CVE-2026-48618: A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Impacted Vendors

nodejs 1

Reference Links

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

Source Entity 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Severity HIGH

7.7

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.7

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns