CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Other sources
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0Fixed in 24.17.0Fixed in 26.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.17.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-48618?
The severity of CVE-2026-48618 is high, with a score of 7.7.
What is CVE-2026-48618 about?
CVE-2026-48618 addresses a flaw in Node.js TLS hostname handling that may lead to authentication bypass.
How does CVE-2026-48618 affect Node.js?
CVE-2026-48618 affects Node.js versions 22, 24, and 26 through insecure handling of unicode dot separators in hostnames.
How do I fix CVE-2026-48618?
To fix CVE-2026-48618, you should upgrade to a patched version of Node.js as soon as possible.
What are the potential impacts of CVE-2026-48618?
The potential impacts of CVE-2026-48618 include confidentiality issues and bypassing of intended security boundaries.