Read the docs
TI-2026-35964 Aliases CVE-2026-48618GHSA-g57m-hr98-5m89

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling…

Priority LOW 35CWE-176Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 6 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03139 87th percentileScored 2026-11-07
Fix Partial Red Hat: 13 advisoriesRed Hat: 6 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSnode22.22.3 – 22.22.3; 24.16.0 – 24.16.0; 26.3.0 – 26.3.0—No fix listedCNA
  • node VendorNodeJS Affected 22.22.3 – 22.22.3; 24.16.0 – 24.16.0; 26.3.0 – 26.3.0 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*22.22.3VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*24.16.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*26.3.0VulnerableNodeJS
  • cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:* Versions 22.22.3 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:* Versions 24.16.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:* Versions 26.3.0 Vulnerable ·NodeJS

Remediation

Red Hat 13 advisories

  • RHSA-2026:52399 Released 2026-08-10 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22, nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22, nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22 +28
  • RHSA-2026:41947 Released 2026-07-20 · Red Hat rating Important
    nodejs:22 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.aarch64::nodejs:22, nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.ppc64le::nodejs:22, nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.s390x::nodejs:22 +28
  • RHSA-2026:39868 Released 2026-07-15 · Red Hat rating Important
    nodejs:24 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.18.0-1.module+el8.10.0+24481+7a71fac8.aarch64::nodejs:24, nodejs-1:24.18.0-1.module+el8.10.0+24481+7a71fac8.ppc64le::nodejs:24, nodejs-1:24.18.0-1.module+el8.10.0+24481+7a71fac8.s390x::nodejs:24 +25
Show 10 more Red Hat advisories
  • RHSA-2026:39246 Released 2026-07-14 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.23.1-2.el10_0, nodejs-devel-1:22.23.1-2.el10_0, nodejs-docs-1:22.23.1-2.el10_0 +4
  • RHSA-2026:35892 Released 2026-07-06 · Red Hat rating Important
    nodejs:22 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.23.1-1.module+el9.8.0+24457+996af7aa.aarch64::nodejs:22, nodejs-1:22.23.1-1.module+el9.8.0+24457+996af7aa.ppc64le::nodejs:22, nodejs-1:22.23.1-1.module+el9.8.0+24457+996af7aa.s390x::nodejs:22 +28
  • RHSA-2026:35891 Released 2026-07-06 · Red Hat rating Important
    nodejs:24 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.18.0-1.module+el9.8.0+24456+b244c3b4.aarch64::nodejs:24, nodejs-1:24.18.0-1.module+el9.8.0+24456+b244c3b4.ppc64le::nodejs:24, nodejs-1:24.18.0-1.module+el9.8.0+24456+b244c3b4.s390x::nodejs:24 +25
  • RHSA-2026:35842 Released 2026-07-06 · Red Hat rating Important
    nodejs22 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.23.1-2.el10_2, nodejs-devel-1:22.23.1-2.el10_2, nodejs-docs-1:22.23.1-2.el10_2 +4
  • RHSA-2026:35841 Released 2026-07-06 · Red Hat rating Important
    nodejs24 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.18.0-1.el10_2, nodejs24-devel-1:24.18.0-1.el10_2, nodejs24-docs-1:24.18.0-1.el10_2 +3
  • RHSA-2026:30172 Released 2026-06-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs26-1:26.4.0-1.2.hum1@aarch64, nodejs26-1:26.4.0-1.2.hum1@src, nodejs26-1:26.4.0-1.2.hum1@x86_64 +14
  • RHSA-2026:29012 Released 2026-06-24 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs24-1:24.18.0-0.1.hum1@aarch64, nodejs24-1:24.18.0-0.1.hum1@src, nodejs24-1:24.18.0-0.1.hum1@x86_64 +14
  • RHSA-2026:28727 Released 2026-06-24 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs22-1:22.23.1-1.hum1@aarch64, nodejs22-1:22.23.1-1.hum1@src, nodejs22-1:22.23.1-1.hum1@x86_64 +14
  • RHSA-2026:9455 Released 2026-04-21 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs20-20.20.2-1.hum1@aarch64, nodejs20-20.20.2-1.hum1@src, nodejs20-20.20.2-1.hum1@x86_64 +14
  • RHSA-2026:7378 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs25-25.9.0-1.1.hum1@aarch64, nodejs25-25.9.0-1.1.hum1@src, nodejs25-25.9.0-1.1.hum1@x86_64 +14

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:35841, RHSA-2026:35842
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:39868, RHSA-2026:41947
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:35891, RHSA-2026:35892
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:39246
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:52399
Red Hat Hardened ImagesFixed RHSA-2026:28727, RHSA-2026:29012, RHSA-2026:30172, RHSA-2026:7378, RHSA-2026:9455
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48618
  2. 2026-10-03 Alias added: GHSA-g57m-hr98-5m89
  3. 2026-10-13 Affected versions changed · Red Hat
  4. 2026-10-18 Affected versions changed · Red Hat
  5. 2026-10-20 Affected versions changed · Red Hat

References

Patch 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
  • TI-2022-03315 X.509 Email Address 4-byte Buffer Overflow CVSS 3.1HIGH 7.5
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences