CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0Fixed in 24.17.0Fixed in 26.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.17.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-48928?
The severity of CVE-2026-48928 is rated as medium with a CVSS score of 5.4.
How do I fix CVE-2026-48928?
CVE-2026-48928 can be fixed by applying the available patches provided in the Node.js security releases.
Which versions are affected by CVE-2026-48928?
CVE-2026-48928 affects all supported release lines of Node.js: version 22, version 24, and version 26.
What is the nature of CVE-2026-48928?
CVE-2026-48928 involves a hostname matching inconsistency that can lead to a trust-policy bypass in multi-context mTLS setups.
When was CVE-2026-48928 published?
CVE-2026-48928 was published on June 26, 2026.