CVE-2026-48928

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.0.0 through 26.3.0

Description An inconsistency in hostname matching can lead to a trust-policy bypass within multi-context mTLS (mutual Transport Layer Security) setups. mTLS is a process where both the client and server authenticate each other using digital certificates.

Recommendations Update Node.js 22 to the latest patched version. Update Node.js 24 to the latest patched version. Update Node.js 26 to version 26.3.1-1.1 or later.