Skip to main content

Node.js CVE-2026-48930

| EUVDEUVD-2026-39614 CRITICAL
Improper Access Control (CWE-284)
2026-06-18 GHSA-g779-8rvr-37xx
Authentication Bypass Node Js Red Hat Suse
Critical
Disputed · 9.8 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.8 MEDIUM

Remote and unauthenticated, but AC:H and only partial C/I impact because a bypass depends on an application using the hostname for a security decision; no availability impact, consistent with the vendor's Medium rating rather than 9.8.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Red Hat
5.6 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jun 26, 2026 - 20:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 26, 2026 - 20:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 26, 2026 - 20:22 vuln.today
cvss_changed
Severity Changed
Jun 26, 2026 - 20:22 NVD
MEDIUM CRITICAL
CVSS changed
Jun 26, 2026 - 20:22 NVD
5.6 (MEDIUM) 9.8 (CRITICAL)
Source Code Evidence Fetched
Jun 26, 2026 - 02:25 vuln.today
Analysis Generated
Jun 26, 2026 - 02:25 vuln.today
CVSS changed
Jun 26, 2026 - 02:22 NVD
5.6 (MEDIUM)
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Hostname validation bypass in Node.js (versions 22.22.3, 24.16.0, and 26.3.0) lets attackers smuggle embedded NUL bytes through the dns and net subsystems, truncating a hostname after the NUL so that application-level allowlists, SNI checks, or destination filters validate one host while the runtime resolves or connects to another. The Node.js project rates this specific issue Medium and shipped the fix in its June 2026 security release; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.28%, 20th percentile), and it is not in CISA KEV. Note a significant signal conflict: the aggregate input score of CVSS 9.8 with an 'Authentication Bypass' tag is far above the vendor's own Medium rating for this CVE and appears to be an inflated pre-NVD auto-score.

Technical ContextAI

The flaw lives in Node.js core networking primitives (the dns and net modules). Hostnames are byte strings restricted to a limited character set; an embedded NUL (0x00) is illegal but, prior to this fix, was not rejected. Underlying C/OS resolver and socket APIs treat NUL as a string terminator, so a value like 'trusted.example.com\x00.attacker.com' can be validated by JavaScript code as the full string yet resolved/connected as 'trusted.example.com' (or the inverse). This parsing mismatch maps to CWE-284 (Improper Access Control). The fix, authored by Matteo Collina, makes dns/net explicitly reject hostnames containing embedded NUL bytes. Per CPE data the affected builds are nodejs:node.js 22.22.3, 24.16.0, and 26.3.0, with the patched Current line being 26.3.1.

RemediationAI

Vendor-released patch: upgrade to Node.js 26.3.1 on the Current line, or the corresponding patched 24.x and 22.x releases from the same June 2026 batch (https://nodejs.org/en/blog/vulnerability/june-2026-security-releases and https://github.com/nodejs/node/releases/tag/v26.3.1). As an interim application-level control while you stage the upgrade, reject any hostname containing a NUL byte before it reaches dns.lookup/dns.resolve or net/tls connect calls - validate user-supplied hosts against a strict character allowlist and drop values where the string contains '\x00'; the trade-off is that this only protects code paths you control and misses hostnames flowing through third-party dependencies, so it is a stopgap, not a substitute for patching. Additionally re-audit any SSRF allowlist or host-identity check that compares the raw hostname string, since those are the controls this flaw subverts.

More in Node Js

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2014-7192 CRITICAL POC
10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
CVE-2015-3194 HIGH
7.5 Dec 06

crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial

CVE-2016-2105 HIGH
7.5 May 05

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2
CVE-2022-3786 HIGH POC
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2024-3566 CRITICAL POC
9.8 Apr 10

Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
CVE-2022-0778 HIGH POC
7.5 Mar 15

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-48930 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy