Skip to main content

Node.js CVE-2026-48928

| EUVDEUVD-2026-39613 MEDIUM
Improper Access Control (CWE-284)
2026-06-18 GHSA-3h92-9jcv-8677
Authentication Bypass Red Hat Suse Node Js
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
4.2 MEDIUM

Network vector with high complexity reflects the need for a multi-SNI server configuration and crafted ClientHello; PR:L required to establish a TLS session; no availability impact applies.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Red Hat
4.2 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

5
CVSS changed
Jun 26, 2026 - 20:22 NVD
4.2 (MEDIUM) 5.4 (MEDIUM)
Source Code Evidence Fetched
Jun 26, 2026 - 02:25 vuln.today
Analysis Generated
Jun 26, 2026 - 02:25 vuln.today
CVSS changed
Jun 26, 2026 - 02:22 NVD
4.2 (MEDIUM)
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

TLS SNI context matching in Node.js performs case-sensitive hostname comparison, enabling network-accessible low-privileged attackers to bypass intended server-side TLS context selection by varying the casing of the SNI hostname in a ClientHello message. Affected versions prior to 26.3.1 may serve an incorrect TLS certificate or context when a client sends an SNI value with unexpected casing (e.g., 'EXAMPLE.COM' versus 'example.com'), yielding limited confidentiality and integrity impacts in multi-hostname deployments. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify Node.js server with multi-SNI TLS configuration
Delivery
Enumerate registered SNI hostnames via probing
Exploit
Craft TLS ClientHello with case-variant SNI value
Execution
Bypass intended SNI context selection in Node.js tls module
Persist
Receive unintended TLS context or certificate
Impact
Exploit weaker policy of mismatched context
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a Node.js TLS server actively configured with multiple SNI-differentiated contexts - specifically, use of the SNICallback mechanism or equivalent multi-certificate TLS server setup where different hostnames map to distinct TLS contexts or certificates. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.0 base score of 4.2 (Medium) accurately reflects the constrained real-world risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with access to a network-reachable Node.js TLS server - one that uses SNI-based context switching to serve different certificates for different virtual hostnames - sends a TLS ClientHello in which the SNI extension contains a hostname with non-standard casing, such as 'Api.EXAMPLE.COM' instead of the registered 'api.example.com'. The Node.js tls module fails to normalize this value before context lookup, causing a miss against the intended context and falling back to a default or alternative TLS context. …
Remediation Upgrade Node.js to version 26.3.1 or later, released 2026-06-18, which contains the fix for case-sensitive SNI context matching as part of the June 2026 security release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node Js

View all
CVE-2024-3566 CRITICAL POC
9.8 Apr 10

Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
CVE-2026-48930 CRITICAL
9.8 Jun 18

Hostname validation bypass in Node.js (versions 22.22.3, 24.16.0, and 26.3.0) lets attackers smuggle embedded NUL bytes

CVE-2025-55130 CRITICAL
9.1 Jan 20

Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrict
CVE-2026-48931 LOW POC
3.7 Jun 18

Response queue poisoning in Node.js http.Agent allows network-accessible attackers to corrupt the HTTP keep-alive connec
CVE-2026-48933 HIGH
7.5 Jun 18

Denial of service in Node.js 26.x (fixed in 26.3.1) arises from an unguarded integer overflow when computing WebCrypto c
CVE-2026-48619 HIGH
7.5 Jun 18

Denial of service in Node.js HTTP/2 lets a remote peer exhaust process memory by driving unbounded growth of the connect
CVE-2026-48615 HIGH
7.5 Jun 18

Sensitive information disclosure in Node.js (versions 26.3.0, 24.16.0, and 22.22.3) leaks embedded proxy credentials whe
CVE-2025-59465 HIGH
7.5 Jan 20

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unha
CVE-2026-48618 MEDIUM
6.5 Jun 18

Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostnam
CVE-2026-48934 MEDIUM
4.3 Jun 18

TLS session resumption in Node.js fails to bind reusable sessions to the originally authenticated host, enabling an info
CVE-2026-48935 LOW
3.3 Jun 18

Node.js permission model bypass via FileHandle.utimes() allows local low-privilege users to modify file timestamps on pa
CVE-2026-48936 LOW
3.3 Jun 18

Node.js Permission Model fails to apply net scope guards to pipe open and chmod operations, enabling a local authenticat

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2025-12480 CRITICAL POC
9.1
CVE-2025-33073 HIGH POC
8.8
CVE-2025-21293 HIGH POC
8.8
CVE-2024-21644 HIGH POC
7.5
CVE-2026-35616 CRITICAL POC
9.8
CVE-2026-34908 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9
CVE-2020-5849 HIGH POC
7.5
CVE-2024-7593 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-48928 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy