Node.js TLS Hostname DoS via Embedded NUL Rebinding
CVE-2026-48930 Published on June 26, 2026
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-48930 has been classified to as an Authorization vulnerability or weakness.
Affected Versions
nodejs node:- Version 22.22.3, <= 22.22.3 is affected.
- Version 24.16.0, <= 24.16.0 is affected.
- Version 26.3.0, <= 26.3.0 is affected.