CVE-2026-48930

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.x and earlier

Description A flaw in TLS hostname handling allows embedded-nul hostnames to cause silent authority rebinding. This occurs due to c-string truncation in resolver bindings, where a null character in the hostname string terminates the string prematurely in the underlying C code, potentially leading the application to connect to an unintended destination.

Recommendations Update Node.js 22 to the latest patched version. Update Node.js 24 to the latest patched version. Update Node.js 26 to version 26.3.1-1.1 or later.