CVE-2026-48933Patch(nodejs / node.js)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch nodejs node.js systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

nodejs CVEs Back to dashboard

0.8/ 10 priority

Sources & remediation

Patch / fix

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Other references

Weakness type (CWE)

CWE-190CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

node.js

Threat summary

Patch or workaround signal is available
8 mentions across 8 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 7d ago at 1 mentions (2026-06-18); latest day: 1
8 total mentions across 8 days

Affected systems

Vendors

nodejs

Products

node.js

3 versions affected across 1 product

Deep dive

Activity timeline8 mentions / 8d

Signal classification3 categories

Patch

562.5%

Disclosure

225.0%

General

112.5%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-18	1	Patch1
2026-06-19	1	Patch1
2026-06-21	1	Patch1
2026-06-22	1	Patch1
2026-06-25	1	Patch1
2026-06-26	1	Disclosure1
2026-07-02	1	Disclosure1
2026-07-04	1	General1

Full discourse8 posts

Daily CyberSecurity@the_yellow_fall91d
Patch
Protect your servers with the latest Node.js security updates. Patch critical vulnerabilities like CVE-2026-48933 to secure your infrastructure today. #NodeJS #SecurityUpdates #Cybersecurity #CVE #WebSecurity https://securityonline.info/nodejs-security-updates https://t.co/gAz8IUJpzm
Post summary
The tweet urges Node.js users to apply the latest security updates, specifically prompting a patch for CVE-2026-48933, with no exploit details or technical vulnerability information provided.
01041445
12.8K followersView on X
CERT-PY@CERTpy78d
Disclosure
⚠️ Vulnerabilidades en productos Node.js ❗ CVE-2026-48933 ❗ CVE-2026-48618 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-node-js-2/ https://t.co/HuO8PJ3WnA
Post summary
The tweet announces two new CVE identifiers affecting Node.js products and links to a CERT page for additional information.
01020278
6.7K followersView on X
Stuart 🇨🇷@stooee_75d
General
After analyzing 66% of vulnerabilities from past week, CVE-2026-48933 has 9 articles published from different internet sources, no other cve has these many articles. More information here: https://cves.st00ee.com/ #vulnerability #CyberSecurity #ThreatIntel #CVE #SecurityAlert
Post summary
The post notes that CVE-2026-48933 has drawn significant media attention, directing readers to an external link for more information, but it offers no technical details or evidence of exploitation.
0000043
75 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds84d
Disclosure
CVE-2026-48933 Denial of Service in Node.js WebCrypto Implementation via Large Input https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48933
Post summary
CVE-2026-48933 is a Denial of Service vulnerability in Node.js WebCrypto caused by processing large inputs. The post merely announces the vulnerability; it does not provide PoC code, active exploitation evidence, or patch information.
00000122
4.1K followersView on X
Luis Torres@4Ndr3w1000085d
Patch
Node shipped security releases on June 18. CVE-2026-48933 is an integer overflow in WebCrypto subtle.encrypt() that can crash the process, and it affects every active line: 22.x, 24.x, 26.x. Patch to 22.23.0, 24.17.0, or 26.3.1. It is a real DoS, not theoretical. Update today.
Post summary
Node’s CVE-2026-48933 is an integer overflow in WebCrypto’s subtle.encrypt() that leads to a real denial‑of‑service; patches for releases 22.23.0, 24.17.0, and 26.3.1 are available and should be applied promptly.
0000052
35 followersView on X
セキュリティ対策Lab@securityLab_jp88d
Patch
Node.js、2026年6月のセキュリティリリースで12件の脆弱性を修正(CVE-2026-48933,CVE-2026-48618)他 https://rocket-boys.co.jp/security-measures-lab/nodejs-vulnerabilities-cve-2026-48933-cve-2026-48618/ #セキュリティ対策Lab #security #securitynews
Post summary
Node.js announced its June 2026 security release, fixing 12 vulnerabilities including CVE-2026-48933 and CVE-2026-48618, as noted by the linked security update.
00000117
436 followersView on X
Diego Artiles@dartilesm89d
Patch
🚨 Node.js patched all active LTS lines on June 18. CVE-2026-48618: IPv6 dots bypass TLS wildcard certs. CVE-2026-48933: WebCrypto AES crash, remote process abort. Patch to 22.23.0 / 24.17.0 / 26.3.1. How long before your team ships this?
Post summary
The text announces Node.js patches for CVE-2026-48618 and CVE-2026-48933, specifying affected LTS versions and providing the patched release numbers.
0000045
49 followersView on X
Can Artuc@canartuc91d
Patch
Node.js shipped 22.23.0, 24.17.0 and 26.3.1 on June 18, fixing 13 CVEs. Two are rated HIGH: CVE-2026-48933, a WebCrypto AES integer overflow that aborts the process, and CVE-2026-48618, a TLS wildcard-depth check fooled by a Unicode dot separator. Which release line do you run?
Post summary
Node.js released updates 22.23.0, 24.17.0, and 26.3.1 that patch two high‑severity CVEs affecting WebCrypto AES and TLS wildcard depth handling.
0000047
171 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nodejs	node.js	22.22.3	-	-
App	nodejs	node.js	24.16.0	-	-
App	nodejs	node.js	26.3.0	-	-

Explore more

Back to dashboard nodejs CVEs node.js vulnerabilities

What researchers are saying

CVE-2026-48933

セキュリティ対策Lab[verified]@securityLab_jpPatch

Node.js announced its June 2026 security release, fixing 12 vulnerabilities including CVE-2026-48933 and CVE-2026-48618, as noted by the linked security update.

Diego Artiles[verified]@dartilesmPatch

The text announces Node.js patches for CVE-2026-48618 and CVE-2026-48933, specifying affected LTS versions and providing the patched release numbers.

Can Artuc[verified]@canartucPatch

Node.js released updates 22.23.0, 24.17.0, and 26.3.1 that patch two high‑severity CVEs affecting WebCrypto AES and TLS wildcard depth handling.

Daily CyberSecurity@the_yellow_fallPatch

The tweet urges Node.js users to apply the latest security updates, specifically prompting a patch for CVE-2026-48933, with no exploit details or technical vulnerability information provided.

CERT-PY@CERTpyDisclosure

The tweet announces two new CVE identifiers affecting Node.js products and links to a CERT page for additional information.

Stuart 🇨🇷@stooee_General

The post notes that CVE-2026-48933 has drawn significant media attention, directing readers to an external link for more information, but it offers no technical details or evidence of exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

CVE-2026-48933 is a Denial of Service vulnerability in Node.js WebCrypto caused by processing large inputs. The post merely announces the vulnerability; it does not provide PoC code, active exploitation evidence, or patch information.

Luis Torres@4Ndr3w10000Patch

Node’s CVE-2026-48933 is an integer overflow in WebCrypto’s subtle.encrypt() that leads to a real denial‑of‑service; patches for releases 22.23.0, 24.17.0, and 26.3.1 are available and should be applied promptly.