Skip to content
OpenAdvisories
High · 7.7 CVE-2026-48618 EUVD-2026-39610GHSA-g57m-hr98-5m89

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypa…

Published Jun 26, 2026 · Updated Aug 10, 2026 · Assigned by hackerone

Description

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Affected products

VendorProductAffectedFixed
nodejs node 22.22.3 – ≤ 22.22.3, 24.16.0 – ≤ 24.16.0, 26.3.0 – ≤ 26.3.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 nodejs 24.17.0+dfsg+~cs24.13.2-1 —
Debian 13 nodejs 20.19.2+dfsg-1+deb13u3 —
Debian 12 nodejs 18.20.4+dfsg-1~deb12u3 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 nodejs No fix yet —
Ubuntu 26.04 LTS nodejs No fix yet —
Ubuntu 25.10 nodejs No fix yet —
Ubuntu 24.04 LTS nodejs No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS nodejs No fix yet —
Ubuntu Pro 20.04 LTS nodejs No fix yet —
Ubuntu Pro 18.04 LTS nodejs No fix yet —
Ubuntu Pro 16.04 LTS nodejs No fix yet —
Ubuntu Pro 14.04 LTS nodejs No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 nodejs +5 1:22.23.1-2.el10_2 RHSA-2026:35842
RHEL 10 nodejs-npm 1:10.9.8-1.22.23.1.2.el10_2 RHSA-2026:35842
RHEL 10 nodejs24 +4 1:24.18.0-1.el10_2 RHSA-2026:35841
RHEL 10 nodejs24-npm 1:11.16.0-1.24.18.0.1.el10_2 RHSA-2026:35841
RHEL 9 nodejs +4 1:22.23.1-1.module+el9.8.0+24457+996af7aa RHSA-2026:35892, RHSA-2026:35891
RHEL 9 nodejs-nodemon 3.0.1-1.module+el9.8.0+24156+bb41d456 RHSA-2026:35892, RHSA-2026:35891
RHEL 9 nodejs-packaging +1 2021.06-6.module+el9.8.0+24156+bb41d456 RHSA-2026:35892, RHSA-2026:35891
RHEL 9 npm 1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa RHSA-2026:35892, RHSA-2026:35891
RHEL 9 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module+el9.8.0+24457+996af7aa RHSA-2026:35892
RHEL 9 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4 RHSA-2026:35891
RHEL 8 nodejs +4 1:22.23.1-1.module+el8.10.0+24500+8eb51621 RHSA-2026:41947, RHSA-2026:39868
RHEL 8 nodejs-nodemon 3.0.1-1.module+el8.10.0+24500+8eb51621 RHSA-2026:41947, RHSA-2026:39868
RHEL 8 nodejs-packaging +1 2021.06-6.module+el8.10.0+24190+49a46c75 RHSA-2026:41947, RHSA-2026:39868
RHEL 8 npm 1:10.9.8-1.22.23.1.1.module+el8.10.0+24500+8eb51621 RHSA-2026:41947, RHSA-2026:39868
RHEL 8 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module+el8.10.0+24500+8eb51621 RHSA-2026:41947
RHEL 8 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8 RHSA-2026:39868
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS nodejs +5 1:22.23.1-2.el10_0 RHSA-2026:39246
RHEL 10.0 EUS nodejs-npm 1:10.9.8-1.22.23.1.2.el10_0 RHSA-2026:39246
RHEL 9.6 EUS nodejs +4 1:22.23.1-2.module+el9.6.0+24604+449f851b RHSA-2026:52399
RHEL 9.6 EUS nodejs-nodemon 3.1.14-1.module+el9.6.0+24604+449f851b RHSA-2026:52399
RHEL 9.6 EUS nodejs-packaging +1 2021.06-4.module+el9.6.0+23473+45664c2d RHSA-2026:52399
RHEL 9.6 EUS npm 1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b RHSA-2026:52399
RHEL 9.6 EUS v8-12.4-devel 3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b RHSA-2026:52399
Red Hat Hardened Images 1 nodejs20 +6 20.20.2-1.hum1 RHSA-2026:9455
Red Hat Hardened Images 1 nodejs20-npm 10.8.2-1.20.20.2.1.hum1 RHSA-2026:9455
Red Hat Hardened Images 1 nodejs22 +6 22.23.1-1.hum1 RHSA-2026:28727
Red Hat Hardened Images 1 nodejs22-npm 10.9.8-1.22.23.1.1.hum1 RHSA-2026:28727
Red Hat Hardened Images 1 nodejs24 +6 24.18.0-0.1.hum1 RHSA-2026:29012
Red Hat Hardened Images 1 nodejs24-npm 11.16.0-1.24.18.0.0.1.hum1 RHSA-2026:29012
Red Hat Hardened Images 1 nodejs25 +6 25.9.0-1.1.hum1 RHSA-2026:7378
Red Hat Hardened Images 1 nodejs25-npm 11.12.1-1.25.9.0.1.1.hum1 RHSA-2026:7378
Red Hat Hardened Images 1 nodejs26 +6 26.4.0-1.2.hum1 RHSA-2026:30172
Red Hat Hardened Images 1 nodejs26-npm 11.17.0-1.26.4.0.1.2.hum1 RHSA-2026:30172

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 nodejs +4 1:22.23.1-2.el10_2 ALSA-2026:35842
AlmaLinux 10 nodejs-npm 1:10.9.8-1.22.23.1.2.el10_2 ALSA-2026:35842
AlmaLinux 10 nodejs24 +4 1:24.18.0-1.el10_2 ALSA-2026:35841
AlmaLinux 10 nodejs24-npm 1:11.16.0-1.24.18.0.1.el10_2 ALSA-2026:35841
AlmaLinux 9 nodejs +4 1:22.23.1-1.module_el9.8.0+276+8b329b47 ALSA-2026:35892, ALSA-2026:35891
AlmaLinux 9 nodejs-nodemon 3.0.1-1.module_el9.7.0+208+fb06c0ab ALSA-2026:35892, ALSA-2026:35891
AlmaLinux 9 nodejs-packaging +1 2021.06-6.module_el9.7.0+209+ecf6523e ALSA-2026:35892, ALSA-2026:35891
AlmaLinux 9 npm 1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47 ALSA-2026:35892, ALSA-2026:35891
AlmaLinux 9 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 ALSA-2026:35892
AlmaLinux 9 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e ALSA-2026:35891
AlmaLinux 8 nodejs +4 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 ALSA-2026:41947, ALSA-2026:39868
AlmaLinux 8 nodejs-nodemon 3.0.1-1.module_el8.10.0+3956+47c9ee9f ALSA-2026:41947, ALSA-2026:39868
AlmaLinux 8 nodejs-packaging +1 2021.06-6.module_el8.10.0+4086+70facd4a ALSA-2026:41947, ALSA-2026:39868
AlmaLinux 8 npm 1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855 ALSA-2026:41947, ALSA-2026:39868
AlmaLinux 8 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855 ALSA-2026:41947
AlmaLinux 8 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94 ALSA-2026:39868

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 nodejs22 1:22.23.1-2.el10_2 RLSA-2026:35842
Rocky Linux 10 nodejs24 1:24.18.0-1.el10_2 RLSA-2026:35841
Rocky Linux 9 nodejs-nodemon 3.0.1-1.module+el9.7.0+40022+9ecc286c RLSA-2026:97855, RLSA-2026:35892, RLSA-2026:35891
Rocky Linux 9 nodejs-packaging 2021.06-6.module+el9.7.0+40052+e32ea525 RLSA-2026:97855, RLSA-2026:35892, RLSA-2026:35891
Rocky Linux 8 nodejs 1:24.18.0-1.module+el8.10.0+40252+a58646bc RLSA-2026:39868
Rocky Linux 8 nodejs-nodemon 3.0.1-1.module+el8.9.0+1760+903d54b9 RLSA-2026:41947, RLSA-2026:39868
Rocky Linux 8 nodejs-packaging 2021.06-6.module+el8.10.0+40048+6d99f608 RLSA-2026:41947, RLSA-2026:39868
ReleasePackageFixed inAdvisory
SLES 15 SP7 nodejs22 22.23.0-150700.3.12.1 SUSE-SU-2026:2695-1
SLES 15 SP7 nodejs24 24.17.0-150700.15.11.1 SUSE-SU-2026:2633-1
SLES 15 SP6 nodejs20 20.20.2-150600.3.21.1 SUSE-SU-2026:3929-1
SLES 15 SP6 nodejs22 22.23.0-150600.13.18.1 SUSE-SU-2026:2647-1
SLES 15 SP5 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
SLES 15 SP5 nodejs20 20.20.2-150500.11.30.1 SUSE-SU-2026:3930-1
SLES 15 SP4 nodejs16 16.20.2-150400.3.42.1 SUSE-SU-2026:4355-1
SLES 15 SP4 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
SLES 12 SP5 nodejs18 18.20.8-8.44.1 SUSE-SU-2026:4248-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 nodejs22 22.23.0-160000.1.1 SUSE-SU-2026:22368-1
SLES for SAP 16.0 nodejs24 24.18.0-160000.1.1 SUSE-SU-2026:22565-1
SLES for SAP 15 SP6 nodejs20 20.20.2-150600.3.21.1 SUSE-SU-2026:3929-1
SLES for SAP 15 SP6 nodejs22 22.23.0-150600.13.18.1 SUSE-SU-2026:2647-1
SLES for SAP 15 SP5 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
SLES for SAP 15 SP5 nodejs20 20.20.2-150500.11.30.1 SUSE-SU-2026:3930-1
SLES for SAP 15 SP4 nodejs16 16.20.2-150400.3.42.1 SUSE-SU-2026:4355-1
SLES for SAP 15 SP4 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
SLES 16.0 nodejs22 22.23.0-160000.1.1 SUSE-SU-2026:22368-1
SLES 16.0 nodejs24 24.18.0-160000.1.1 SUSE-SU-2026:22565-1
SLE HPC 15 SP5 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
SLE HPC 15 SP5 nodejs20 20.20.2-150500.11.30.1 SUSE-SU-2026:3930-1
SLE HPC 15 SP4 nodejs16 16.20.2-150400.3.42.1 SUSE-SU-2026:4355-1
SLE HPC 15 SP4 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bun 1.4.4-1.1 openSUSE-SU-2026:12316-1
openSUSE Tumbleweed nodejs24 24.17.0-1.1 openSUSE-SU-2026:11121-1
openSUSE Tumbleweed nodejs26 26.3.1-1.1 openSUSE-SU-2026:11110-1
openSUSE Leap 16.0 nodejs22 22.23.0-160000.1.1 openSUSE-SU-2026:21058-1
openSUSE Leap 16.0 nodejs24 24.18.0-160000.1.1 openSUSE-SU-2026:21236-1
ReleasePackageFixed inAdvisory
Alpine v3.24 nodejs 24.17.0-r0 —
Alpine v3.23 nodejs 24.17.0-r0 —
Alpine v3.22 nodejs 22.23.0-r0 —
Alpine v3.21 nodejs 22.23.0-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 nodejs22 +4 1:22.23.1-1.amzn2023.0.1 ALAS2023-2026-1921
Amazon Linux 2023 nodejs22-npm 1:10.9.8-1.22.23.1.1.amzn2023.0.1 ALAS2023-2026-1921
Amazon Linux 2023 nodejs24 +4 1:24.18.0-1.amzn2023.0.1 ALAS2023-2026-1920
Amazon Linux 2023 nodejs24-npm 1:11.16.0-1.24.18.0.1.amzn2023.0.1 ALAS2023-2026-1920
Amazon Linux 2023 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.amzn2023.0.1 ALAS2023-2026-1921
Amazon Linux 2023 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.amzn2023.0.1 ALAS2023-2026-1920

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 nodejs 24.17.0-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 nodejs +4 1:22.23.1-2.el10_2 ELSA-2026-35842
Oracle Linux 10 nodejs-npm 1:10.9.8-1.22.23.1.2.el10_2 ELSA-2026-35842
Oracle Linux 10 nodejs24 +4 1:24.18.0-1.0.1.el10_2 ELSA-2026-35841
Oracle Linux 10 nodejs24-npm 1:11.16.0-1.24.18.0.1.0.1.el10_2 ELSA-2026-35841
Oracle Linux 9 nodejs +4 1:22.23.1-1.module+el9.8.0+90947+d3e8e647 ELSA-2026-35892, ELSA-2026-35891
Oracle Linux 9 nodejs-nodemon 3.0.1-1.module+el9.8.0+90947+d3e8e647 ELSA-2026-35892, ELSA-2026-35891
Oracle Linux 9 nodejs-packaging +1 2021.06-6.module+el9.8.0+90946+13dc792a ELSA-2026-35892, ELSA-2026-35891
Oracle Linux 9 npm 1:10.9.8-1.22.23.1.1.module+el9.8.0+90947+d3e8e647 ELSA-2026-35892, ELSA-2026-35891
Oracle Linux 9 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module+el9.8.0+90947+d3e8e647 ELSA-2026-35892
Oracle Linux 9 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+90946+13dc792a ELSA-2026-35891
Oracle Linux 8 nodejs +4 1:22.23.1-1.module+el8.10.0+90968+e271b286 ELSA-2026-41947, ELSA-2026-39868
Oracle Linux 8 nodejs-nodemon 3.0.1-1.module+el8.10.0+90968+e271b286 ELSA-2026-41947, ELSA-2026-39868
Oracle Linux 8 nodejs-packaging +1 2021.06-4.module+el8.10.0+90968+e271b286 ELSA-2026-41947, ELSA-2026-39868
Oracle Linux 8 npm 1:10.9.8-1.22.23.1.1.module+el8.10.0+90968+e271b286 ELSA-2026-41947, ELSA-2026-39868
Oracle Linux 8 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module+el8.10.0+90968+e271b286 ELSA-2026-41947
Oracle Linux 8 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+90961+a86f8457 ELSA-2026-39868

Advisories 50

References