Node.js Hostname Matching Trust-Policy Bypass in Multi-Context mTLS
CVE-2026-48928 Published on June 26, 2026
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-48928 has been classified to as an Authorization vulnerability or weakness.
Affected Versions
nodejs node:- Version 22.22.3, <= 22.22.3 is affected.
- Version 24.16.0, <= 24.16.0 is affected.
- Version 26.3.0, <= 26.3.0 is affected.