Skip to main content

Node.js EUVDEUVD-2026-39612

| CVE-2026-48934 MEDIUM
Improper Certificate Validation (CWE-295)
2026-06-18 GHSA-px9q-xv67-75fr
Information Disclosure Node.js Node Js
4.3
CVSS 3.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
3.1 LOW

AC:H reflects that exploitation requires active session reuse across multiple hosts; C:L only, as no integrity or availability impact is described.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

4
Source Code Evidence Fetched
Jun 26, 2026 - 02:25 vuln.today
Analysis Generated
Jun 26, 2026 - 02:25 vuln.today
CVSS changed
Jun 26, 2026 - 02:22 NVD
4.3 (MEDIUM)
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

TLS session resumption in Node.js fails to bind reusable sessions to the originally authenticated host, enabling an information disclosure pathway. Affected versions are Node.js 26.x prior to 26.3.1 (Current channel), as disclosed in the June 2026 security release. An attacker with low network-level privilege can cause a cached TLS session-established and authenticated against one hostname-to be reused for a distinct, attacker-influenced host, potentially bypassing host-based authentication. No public exploit code or CISA KEV listing is present at time of analysis.

Technical ContextAI

Node.js implements TLS via its native tls module, wrapping OpenSSL session resumption mechanisms (session IDs and session tickets). TLS session resumption allows a client to skip the full handshake by reusing cryptographic state from a prior connection, identified by a session ticket or ID. The root cause here is that Node.js did not enforce that a cached session object is scoped exclusively to the hostname against which it was originally authenticated. When an application establishes TLS connections to multiple hosts-or when a session cache is shared across connection targets-a session validated for host A could be incorrectly resumed against host B, undermining the trust anchor of the TLS handshake. The fix commit (tls: bind reusable sessions to authenticated host) enforces hostname binding on session reuse. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and 'Information Disclosure' tag confirm the scope is limited to confidentiality. No CWE was formally assigned; this maps most naturally to CWE-295 (Improper Certificate Validation) or CWE-297 (Improper Validation of Certificate with Host Mismatch).

RemediationAI

Upgrade Node.js to version 26.3.1 (Current) or later, which is confirmed to contain the fix via commit attributed to Matteo Collina. The vendor advisory and release notes are available at https://nodejs.org/en/blog/vulnerability/june-2026-security-releases and https://github.com/nodejs/node/releases/tag/v26.3.1. If an immediate upgrade is not feasible, a targeted workaround is to disable TLS session resumption in application code by setting secureOptions to suppress session caching (tls.createSecureContext with sessionTimeout: 0 or by not reusing session event data). The trade-off is increased handshake latency and CPU overhead on high-connection-volume services. Applications that exclusively connect to a single TLS endpoint (no multi-host session sharing) have minimal practical exposure but should still patch to eliminate the class of risk. Whether LTS lines require separate patches should be confirmed via the Node.js security blog before assuming non-26.x deployments are safe.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2015-3152 MEDIUM POC
5.9
CVE-2026-85102 CRITICAL POC
9.8
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

EUVD-2026-39612 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy