Skip to main content

Node.js EUVDEUVD-2026-39609

| CVE-2026-48933 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-06-18 GHSA-pvpp-9x2p-fxg3
Information Disclosure Integer Overflow Node Js
7.5
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-reachable WebCrypto operation, no auth or interaction (PR:N/UI:N/AC:L); integer overflow yields a process crash, so availability-only (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jun 26, 2026 - 02:23 vuln.today
Analysis Generated
Jun 26, 2026 - 02:23 vuln.today
CVSS changed
Jun 26, 2026 - 02:22 NVD
7.5 (HIGH)
CVE Published
Jun 18, 2026 - 04:37 github-releases
HIGH 7.5
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Denial of service in Node.js 26.x (fixed in 26.3.1) arises from an unguarded integer overflow when computing WebCrypto cipher output buffer lengths, allowing remote attackers to crash a process that performs SubtleCrypto encrypt/decrypt operations on attacker-influenced data. Rated High by the Node.js project (CVSS 7.5, availability-only impact). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach app endpoint using WebCrypto
Exploit
Submit oversized/crafted cipher input
Execution
Trigger integer overflow in output-length calc
Impact
Process abort / denial of service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target application to invoke the WebCrypto / SubtleCrypto cipher API (subtle.encrypt or subtle.decrypt) on input whose size is influenced by the attacker; the integer overflow is in the cipher output-length computation, so an attacker must be able to supply or trigger an operation with a sufficiently large/crafted length. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated condition whose sole impact is availability - consistent with a crash/abort rather than data exposure or code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a request to an application endpoint that performs a WebCrypto encrypt or decrypt on attacker-controlled data of an attacker-chosen size; the unguarded output-length calculation overflows and the Node.js process aborts, taking the service offline. Given AV:N/AC:L/PR:N/UI:N, this requires no authentication or user interaction where such an endpoint is reachable. …
Remediation Vendor-released patch: Node.js 26.3.1 - upgrade from 26.x to 26.3.1 (or the corresponding patched build on your release line as listed in the Node.js June 2026 security release advisory at https://nodejs.org/en/blog/vulnerability/june-2026-security-releases). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify all systems running Node.js 26.x, prioritizing production servers and those handling WebCrypto operations. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node Js

View all
CVE-2024-3566 CRITICAL POC
9.8 Apr 10

Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
CVE-2026-48930 CRITICAL
9.8 Jun 18

Hostname validation bypass in Node.js (versions 22.22.3, 24.16.0, and 26.3.0) lets attackers smuggle embedded NUL bytes

CVE-2025-55130 CRITICAL
9.1 Jan 20

Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrict
CVE-2026-48931 LOW POC
3.7 Jun 18

Response queue poisoning in Node.js http.Agent allows network-accessible attackers to corrupt the HTTP keep-alive connec
CVE-2026-48619 HIGH
7.5 Jun 18

Denial of service in Node.js HTTP/2 lets a remote peer exhaust process memory by driving unbounded growth of the connect
CVE-2026-48615 HIGH
7.5 Jun 18

Sensitive information disclosure in Node.js (versions 26.3.0, 24.16.0, and 22.22.3) leaks embedded proxy credentials whe
CVE-2025-59465 HIGH
7.5 Jan 20

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unha
CVE-2026-48618 MEDIUM
6.5 Jun 18

Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostnam
CVE-2026-48928 MEDIUM
5.4 Jun 18

TLS SNI context matching in Node.js performs case-sensitive hostname comparison, enabling network-accessible low-privile
CVE-2026-48934 MEDIUM
4.3 Jun 18

TLS session resumption in Node.js fails to bind reusable sessions to the originally authenticated host, enabling an info
CVE-2026-48935 LOW
3.3 Jun 18

Node.js permission model bypass via FileHandle.utimes() allows local low-privilege users to modify file timestamps on pa
CVE-2026-48936 LOW
3.3 Jun 18

Node.js Permission Model fails to apply net scope guards to pipe open and chmod operations, enabling a local authenticat

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2015-8651 HIGH
8.8
CVE-2025-48595 HIGH POC
8.4
CVE-2026-21385 HIGH POC
7.8
CVE-2025-46817 HIGH POC
7.0
CVE-2025-53518 CRITICAL POC
9.8
CVE-2025-6021 HIGH POC
7.5
CVE-2025-46819 MEDIUM POC
6.3
CVE-2026-27809 CRITICAL POC
9.1

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

EUVD-2026-39609 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy