CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0Fixed in 24.17.0Fixed in 26.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.17.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-48934?
CVE-2026-48934 has a medium severity rating of 4.3.
How do I fix CVE-2026-48934?
You can fix CVE-2026-48934 by applying the available patch for Node.js.
Which versions of Node.js are affected by CVE-2026-48934?
CVE-2026-48934 affects Node.js versions 22, 24, and 26.
What risk does CVE-2026-48934 pose?
CVE-2026-48934 poses a risk of bypassing TLS certification validation.
What type of vulnerability is CVE-2026-48934?
CVE-2026-48934 is a flaw in Node.js TLS host verification.