CVE-2026-48618Patch(nodejs / node.js)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch nodejs node.js systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

nodejs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Other references

Weakness type (CWE)

CWE-176CWE-289

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

node.js

Threat summary

Patch or workaround signal is available
7 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked at 2 mentions on most recent observed day (2026-07-02)
7 total mentions across 6 days

Affected systems

Vendors

nodejs

Products

node.js

3 versions affected across 1 product

Deep dive

Activity timeline7 mentions / 6d

Signal classification3 categories

Patch

342.9%

Disclosure

342.9%

General

114.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-19	1	Patch1
2026-06-21	1	Patch1
2026-06-22	1	Patch1
2026-06-26	1	Disclosure1
2026-07-01	1	General1
2026-07-02	2	Disclosure2

Full discourse7 posts

CERT-PY@CERTpy122d
Disclosure
⚠️ Vulnerabilidades en productos Node.js ❗ CVE-2026-48933 ❗ CVE-2026-48618 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-node-js-2/ https://t.co/HuO8PJ3WnA
Post summary
The tweet announces two new Node.js CVEs (CVE-2026-48933 and CVE-2026-48618) and directs readers to a CERT page for further information.
01020278
6.7K followersView on X
Stuart 🇨🇷@stooee_122d
Disclosure
After analyzing 44% of vulnerabilities from past week, CVE-2026-48618 has 9 articles published from different internet sources, no other cve has these many articles. More information here: https://cves.st00ee.com/ #vulnerability #CyberSecurity #ThreatIntel #CVE #SecurityAlert
Post summary
The tweet announces CVE‑2026‑48618, noting many related articles, but does not provide technical details, exploits, or patch information.
0000050
75 followersView on X
Stuart 🇨🇷@stooee_123d
General
After analyzing 33% of vulnerabilities from past week, CVE-2026-48618 has 8 articles published from different internet sources, no other cve has these many articles. More information here: https://cves.st00ee.com/ #vulnerability #CyberSecurity #ThreatIntel #CVE #SecurityAlert
Post summary
The post highlights that CVE-2026-48618 attracted more media attention than other recent CVEs but offers no specific exploit, Patch, or technical details.
0000050
75 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds129d
Disclosure
CVE-2026-48618 TLS Wildcard Authentication Bypass via Unicode Dot Separator in N... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48618 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
This tweet announces CVE‑2026‑48618, identifying it as a TLS wildcard authentication bypass caused by a Unicode dot separator, and provides a link for further details, but offers no PoC, exploit code, or evidence of active exploitation.
00000121
4.1K followersView on X
セキュリティ対策Lab@securityLab_jp133d
Patch
Node.js、2026年6月のセキュリティリリースで12件の脆弱性を修正(CVE-2026-48933,CVE-2026-48618)他 https://rocket-boys.co.jp/security-measures-lab/nodejs-vulnerabilities-cve-2026-48933-cve-2026-48618/ #セキュリティ対策Lab #security #securitynews
Post summary
Node.js released a security update in June 2026 that fixes 12 vulnerabilities, including CVE-2026-48933 and CVE-2026-48618, as announced in the referenced security lab article.
00000117
436 followersView on X
Diego Artiles@dartilesm133d
Patch
🚨 Node.js patched all active LTS lines on June 18. CVE-2026-48618: IPv6 dots bypass TLS wildcard certs. CVE-2026-48933: WebCrypto AES crash, remote process abort. Patch to 22.23.0 / 24.17.0 / 26.3.1. How long before your team ships this?
Post summary
Node.js LTS lines were patched on June 18, fixing CVE-2026-48618 (IPv6 dots TLS wildcard bypass) and CVE-2026-48933 (WebCrypto AES crash), with the applicable upgrade to v22.23.0, v24.17.0, or v26.3.1.
0000045
49 followersView on X
Can Artuc@canartuc136d
Patch
Node.js shipped 22.23.0, 24.17.0 and 26.3.1 on June 18, fixing 13 CVEs. Two are rated HIGH: CVE-2026-48933, a WebCrypto AES integer overflow that aborts the process, and CVE-2026-48618, a TLS wildcard-depth check fooled by a Unicode dot separator. Which release line do you run?
Post summary
Node.js announced a release on June 18 that patches 13 CVEs, including two high‑severity ones (CVE‑2026‑48933 and CVE‑2026‑48618), focusing on the availability of the fixes.
0000047
171 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nodejs	node.js	22.22.3	-	-
App	nodejs	node.js	24.16.0	-	-
App	nodejs	node.js	26.3.0	-	-

Explore more

Back to dashboard nodejs CVEs node.js vulnerabilities

What researchers are saying

CVE-2026-48618

セキュリティ対策Lab[verified]@securityLab_jpPatch

Node.js released a security update in June 2026 that fixes 12 vulnerabilities, including CVE-2026-48933 and CVE-2026-48618, as announced in the referenced security lab article.

Diego Artiles[verified]@dartilesmPatch

Node.js LTS lines were patched on June 18, fixing CVE-2026-48618 (IPv6 dots TLS wildcard bypass) and CVE-2026-48933 (WebCrypto AES crash), with the applicable upgrade to v22.23.0, v24.17.0, or v26.3.1.

Can Artuc[verified]@canartucPatch

Node.js announced a release on June 18 that patches 13 CVEs, including two high‑severity ones (CVE‑2026‑48933 and CVE‑2026‑48618), focusing on the availability of the fixes.

CERT-PY@CERTpyDisclosure

The tweet announces two new Node.js CVEs (CVE-2026-48933 and CVE-2026-48618) and directs readers to a CERT page for further information.

Stuart 🇨🇷@stooee_Disclosure

The tweet announces CVE‑2026‑48618, noting many related articles, but does not provide technical details, exploits, or patch information.

Stuart 🇨🇷@stooee_General

The post highlights that CVE-2026-48618 attracted more media attention than other recent CVEs but offers no specific exploit, Patch, or technical details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

This tweet announces CVE‑2026‑48618, identifying it as a TLS wildcard authentication bypass caused by a Unicode dot separator, and provides a link for further details, but offers no PoC, exploit code, or evidence of active exploitation.