Node.js Patches 12 Vulnerabilities, Including Two High-Severity Auth Bypasses

Key Takeaways

• Node.js has addressed 12 security vulnerabilities, including two high-severity flaws that could lead to authentication bypass and denial-of-service.
• Affected Node.js versions include 22.x, 24.x, and 26.x.
• The most critical issues involve improper handling of Unicode dot separators in TLS hostname verification and an integer overflow in the WebCrypto API.
• Patched releases (v22.23.0, v24.17.0, and v26.3.1) were made available on June 18, 2026.

Node.js Addresses Critical Security Flaws in Latest Update

Node.js has issued crucial security updates to remediate a dozen vulnerabilities spanning its active release lines. These patches, released on June 18, 2026, target high-severity flaws that could facilitate authentication bypasses and denial-of-service (DoS) attacks, alongside several medium and low-severity issues.

The security updates are critical for users running Node.js versions 22.x, 24.x, and 26.x. The most severe vulnerability identified, CVE-2026-48618, concerns the incorrect processing of Unicode dot separators during TLS hostname verification.

This flaw creates a discrepancy between how hostnames are normalized by the system’s resolver and verifier. Exploitation could allow attackers to circumvent TLS wildcard-based authentication, potentially granting unauthorized access or compromising the confidentiality of secure communications, particularly in applications that rely on stringent certificate validation.

High-Severity WebCrypto Vulnerability Detailed

Another high-severity vulnerability, tracked as CVE-2026-48933, impacts the WebCrypto API within Node.js. This issue stems from an integer overflow condition that can be triggered when the input to the subtle.encrypt() function is a multiple of 2 GiB. Successful exploitation of this vulnerability could lead to a remote process crash, resulting in denial-of-service conditions for affected applications. This highlights the inherent risks associated with cryptographic implementations when processing large or malformed data inputs.

Additional Vulnerabilities Patched

Beyond the two critical flaws, Node.js addressed several other security concerns:

• CVE-2026-48934: This medium-severity flaw allows TLS host identity verification to be bypassed through session reuse with a different server name, potentially leading to unauthorized connections if session parameters are improperly handled.
• CVE-2026-48928: An issue involving case-sensitive hostname matching in Server Name Indication (SNI) contexts could enable mutual TLS (mTLS) authorization bypasses in multi-context deployments.
• CVE-2026-48930: Embedded null bytes in hostnames could cause silent authority rebinding due to resolver truncation issues.
• CVE-2026-48619: HTTP/2 clients are vulnerable to unbounded memory growth when processing attacker-controlled ORIGIN frames, potentially causing resource exhaustion and DoS.
• CVE-2026-48615: A medium-severity vulnerability that could leak proxy credentials through error messages, specifically ERR_PROXY_TUNNEL, if credentials are embedded in proxy URLs. This increases the risk of credential compromise via logs or diagnostic outputs.
• CVE-2026-48937: HTTP/2 sessions may fail to clean up after a GOAWAY frame on invalid protocol errors, affecting versions 22.x and 24.x.
• CVE-2026-48617 & CVE-2026-48935: Multiple low-severity permission model bypasses that could allow unintended access to restricted file paths or modification of metadata via process.report.writeReport() path misvalidation and FileHandle.utimes() in the Promises API, respectively.
• CVE-2026-48936: A low-severity issue where Unix domain socket servers can bypass network permission restrictions under specific conditions, representing an incomplete fix for CVE-2026-21636, affecting version 26.x only.
• CVE-2026-48931: A race condition in the HTTP agent could lead to HTTP response queue poisoning, where a client accepts responses before sending requests.

The update also incorporates vital dependency upgrades to mitigate known vulnerabilities in third-party components. These include updates to llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, and various versions of the undici HTTP client across different release lines.

What You Should Do

• Immediately upgrade Node.js to the latest patched versions: v22.23.0, v24.17.0, and v26.3.1.
• Ensure all production environments are running supported Node.js versions; end-of-life versions remain vulnerable and should be decommissioned.
• Regularly review and update all third-party dependencies used within your Node.js applications.
• Implement robust logging and monitoring to detect unusual activity that could indicate an attempted exploitation of these vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.