Node.js CVE-2026-48930

Exploitation requires an application built on the affected Node.js versions (22.22.3, 24.16.0, or 26.3.0) that (1) accepts attacker-influenced hostnames and (2) uses that hostname value in a security-relevant comparison - an SSRF/destination allowlist, SNI/server-identity check, or similar - before handing it to the dns or net modules. The decisive limiting factor is this dependency: in applications that make no access-control decision based on the hostname string, an embedded NUL simply yields an invalid lookup with no security consequence. No authentication or user interaction is required to submit the malicious hostname on an exposed input path, but a bypass only occurs when the validated string and the resolved string diverge across the NUL boundary.

Signals conflict and must be reconciled before prioritization. The input carries CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) plus an 'Authentication Bypass' tag, but Node.js itself classifies CVE-2026-48930 as Medium in its release notes - the 9.8 appears to be an inflated pre-NVD/aggregate score rather than a vendor-validated metric and should not be treated as confirmed. EPSS is low (0.28%), the CVE is NOT in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent exploitation. SSVC-style reasoning supports a moderate call: exploitation is unproven, technical impact is partial, and automatability is limited because the bug only matters where an application uses the hostname for a security decision (allowlist/SSRF filter/identity check) before passing it to dns/net. Net assessment: patch on the normal security-update cycle given Node.js's ubiquity, but treat the vendor Medium as authoritative over the 9.8 - this is not a drop-everything emergency.

An application accepts a user-supplied URL or hostname, validates it against an allowlist of permitted hosts, then passes it to Node's net or dns API to connect. An attacker submits 'allowed-host.example.com\x00.evil.com'; the JavaScript allowlist check sees the full benign-looking string and passes it, but the resolver/socket truncates at the NUL and connects to 'allowed-host.example.com' (or, reversed, to an attacker host), bypassing intended access control. The vector is remote, but no public POC is identified and success depends on the target application using the hostname for a security decision.