Skip to main content

Node.js EUVDEUVD-2026-39610

| CVE-2026-48618 MEDIUM
Improper Handling of Unicode Encoding (CWE-176)
2026-06-18 GHSA-g57m-hr98-5m89
Information Disclosure Node.js Node Js
6.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Position as MITM on victim's TLS path
  2. Delivery
    Present cert with non-normalized hostname
  3. Exploit
    Bypass server identity check
  4. Execution
    Victim trusts attacker server
  5. Impact
    Exfiltrate transmitted confidential data

Vulnerability Assessment

Weakness
CWE
CWE-176
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Unicode normalization
Exploitation Conditions

Exploitation targets Node.js applications performing TLS server-identity verification, and depends on the attacker being able to present a peer certificate whose hostname representation exploits the missing normalization (Unicode-equivalent or case/encoding variant of the expected name) so that the identity check incorrectly matches. This typically requires an active man-in-the-middle position or control over a name that normalizes to the victim's expected host; it is not a passive remote-unauthenticated compromise of a default server. Limiting factors: the attacker must intercept or redirect the TLS connection and supply a crafted-name certificate, the impact is confined to confidentiality of data on that connection (no integrity/availability per the vector), and the application must rely on Node's hostname matching rather than certificate pinning. Note the vendor's PR:L and AC:L are not clearly justified by the described client-side scenario and should be verified with Node.js.
Impact

The supplied CVSS:3.0 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) emphasizes a network-reachable, scope-changing confidentiality breach with no integrity or availability impact, consistent with a client trusting an unintended TLS server and leaking data. However, the signals are partly conflicting: a server-identity normalization bypass realistically requires an attacker able to present a certificate to the victim (active MITM or control of a name that normalizes to the target), which argues for higher attack complexity than the vendor's AC:L, and the PR:L privilege requirement is not obviously justified for a TLS client interaction - verify with the vendor. There is no EPSS score, no KEV listing, and no published POC in the input, so this is currently a credible-but-unproven risk rather than an actively exploited one. Net: treat as a real correctness/confidentiality issue worth prompt patching given Node.js ubiquity, but not an emergency on the basis of in-the-wild exploitation, which is not evidenced.
Exploit ScenarioDerived

An attacker positioned to intercept a victim Node.js application's outbound TLS connection (e.g., on a shared network or via DNS/routing manipulation) presents a certificate whose name, in a non-normalized Unicode or case form, slips through the flawed identity check. The Node.js client accepts the connection as the intended server and transmits sensitive data (credentials, tokens, API payloads) to the attacker-controlled endpoint. No public POC is referenced, and the network attack vector means exploitation hinges on the attacker's ability to present such a certificate to the client.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 26, 2026

Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostname be evaluated without proper Unicode/case normalization, so identity checks may match a host they should reject. Rated High by the Node.js team (CVSS 7.7, scope-changed, confidentiality-only), it can cause a client to trust the wrong server and expose data carried over the connection. No public exploit identified at time of analysis; this was disclosed pre-NVD via the nodejs/node June 2026 security release and is not listed in CISA KEV.

RemediationAI

Vendor-released patch: upgrade to Node.js 26.3.1 (or the corresponding patched build for your maintained release line as listed in the Node.js June 2026 security release notes at https://nodejs.org/en/blog/vulnerability/june-2026-security-releases and https://github.com/nodejs/node/releases/tag/v26.3.1). This is the primary and recommended fix. If immediate upgrade is not possible for applications acting as TLS clients, reduce exposure by ensuring connections only go to trusted endpoints (certificate pinning where feasible, strict CA trust stores) and by avoiding reliance on hostname matching for security-sensitive peers; note these controls add operational overhead and do not fully replace the normalization fix. Because the same release bundles multiple TLS/DNS/HTTP fixes (CVE-2026-48933, 48928, 48934, 48930, 48619, and others), upgrading is strongly preferred over piecemeal mitigation.

Affected VersionsENISA

Node 22.22.3 ≤22.22.3
Node 26.3.0 ≤26.3.0
Node 24.16.0 ≤24.16.0

Affected Packages

euvd node no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Node.js performs TLS server identity verification (RFC 6125-style matching of the presented certificate's names against the expected hostname) inside its tls module. The root cause maps to CWE-176 (Improper Handling of Unicode Encoding): the hostname used for the identity check was not normalized before comparison, so visually or canonically equivalent representations (Unicode forms, case differences, or other encoding variants) could be compared inconsistently. The fix, 'tls: normalize hostname for server identity checks' (Matteo Collina), normalizes the hostname prior to matching so equivalent forms collapse to a single canonical value. This sits alongside related TLS hardening in the same release (CVE-2026-48928 case-sensitive SNI matching, CVE-2026-48934 session-host binding, CVE-2026-48930 NUL-byte hostnames), indicating a broader sweep of name-handling correctness in the TLS/DNS layers. No CPE strings were provided in the input; affected scope is inferred from the vendor release rather than NVD CPE data.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today AI 6.8 MEDIUM

Network client flaw requiring MITM/crafted-name positioning (AC:H), no auth on the client side (PR:N); trusting a wrong server breaks the TLS trust boundary (S:C) and exposes data (C:H) without integrity/availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat 7.7 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Severity Changed
Jun 26, 2026 - 20:22 NVD
HIGH MEDIUM
CVSS changed
Jun 26, 2026 - 20:22 NVD
7.7 (HIGH) 6.5 (MEDIUM)
CVSS changed
Jun 26, 2026 - 02:22 NVD
7.7 (HIGH)
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

A vulnerability in Node.js before version 26.3.1 allows attackers to bypass server identity verification in TLS connections; while no public exploits have been identified, successful exploitation could enable man-in-the-middle attacks exposing sensitive data transmitted over connections the application believes are secure. Organizations using affected Node.js versions face potential exposure of credentials and confidential information through encrypted communication channels. Immediate upgrade to Node.js v26.3.1 or later is required to prevent this risk.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 55% exploitable
Prevalence
Ubiquitous
Node.js is a foundational runtime across most modern server stacks
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

33
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

Same weakness CWE-176 – Improper Handling of Unicode Encoding

View all
CVE-2025-71316 CRITICAL POC
9.2
CVE-2026-93990 HIGH POC
8.7
CVE-2026-25480 MEDIUM POC
6.5
CVE-2026-23950 MEDIUM POC
5.9
CVE-2024-24691 CRITICAL
9.8
CVE-2023-39213 CRITICAL
9.8
CVE-2025-55129 MEDIUM POC
5.4
CVE-2023-41889 MEDIUM POC
5.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:28727 ADVISORY https://access.redhat.com/errata/RHSA-2026:29012 ADVISORY https://access.redhat.com/errata/RHSA-2026:30172 ADVISORY https://access.redhat.com/errata/RHSA-2026:7378 ADVISORY https://access.redhat.com/errata/RHSA-2026:9455 ADVISORY https://github.com/nodejs/node/releases/tag/v26.3.1 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-48618 ADVISORY https://seclists.org/oss-sec/2026/q2/984 ADVISORY https://vuldb.com/vuln/374097 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-48618 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2633/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2647/ REF https://access.redhat.com/errata/RHSA-2026:35841 REF https://access.redhat.com/errata/RHSA-2026:35842 REF https://access.redhat.com/errata/RHSA-2026:35891 REF https://access.redhat.com/errata/RHSA-2026:35892 REF https://access.redhat.com/errata/RHSA-2026:39246 REF https://access.redhat.com/errata/RHSA-2026:39868 REF https://access.redhat.com/errata/RHSA-2026:41947 REF https://access.redhat.com/errata/RHSA-2026:52399 REF https://access.redhat.com/security/cve/CVE-2026-48618 REF https://bugzilla.redhat.com/show_bug.cgi?id=2493337 REF https://nodejs.org/en/blog/vulnerability/june-2026-security-releases REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy