CVE-2026-48930

Critical · CVSS 9.8

Node.js — TLS hostname validation bypass via embedded NUL byte / c-string truncation in resolver bindings

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-284

Description

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Search profile — drives PoC discovery

Symbols TLS hostname handlingc-string truncationresolver bindingsembedded-nul hostnameauthority rebindingtls.checkServerIdentitygetaddrinfouv_getaddrinfoNUL byte hostnameSNI hostname

Keywords CVE-2026-48930Node.js TLS NUL hostnameembedded nul TLS bypassc-string truncation resolverauthority rebinding Node.jsNode.js hostname validation bypassCWE-284 Node.js TLSNode.js 22 24 26 TLS flawsilent authority rebindingNode.js june 2026 security

Versions: Node.js 22.x, 24.x, 26.x (all supported release lines)

References

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Status: enriched · ingested 2026-06-27T00:00:38.000Z · profiled 2026-07-01T18:30:14.000Z