Node.js has announced critical security updates that address 12 vulnerabilities across its supported release lines. Among these, two high-severity flaws could lead to denial-of-service (DoS) conditions and authentication bypass.
These updates, released on June 18, 2026, affect Node.js versions 22.x, 24.x, and 26.x. The patched versions are now available as v22.23.0, v24.17.0, and v26.3.1.
Node.js Releases Security Updates
The most severe vulnerability, tracked as CVE-2026-48933, affects the WebCrypto API and can trigger a process crash when handling specially crafted input to the subtle.encrypt() function.
Specifically, inputs that are multiples of 2 GiB can cause an integer overflow, leading to a remote DoS condition. This issue is particularly concerning for applications relying heavily on cryptographic operations in untrusted environments.
Another high-severity flaw, CVE-2026-48618, impacts TLS hostname verification. Improper handling of Unicode dot separators can result in a mismatch between hostname resolution and certificate validation, enabling attackers to bypass TLS wildcard authentication under certain configurations. This could allow unauthorized access or compromise data confidentiality.
In addition to the high-severity issues, several medium-severity vulnerabilities affect HTTP/2, TLS, and proxy handling mechanisms. Notably, CVE-2026-48619 allows attackers to exploit HTTP/2 clients by sending excessive ORIGIN frames, leading to unbounded memory consumption and potential service disruption.
Similarly, CVE-2026-48934 enables TLS host identity verification bypass via session reuse with mismatched server names, posing a risk to secure communications.
Another notable issue, CVE-2026-48615, exposes proxy credentials through error messages when using proxy tunneling. If credentials are embedded in proxy URLs, they may be leaked via logs or diagnostic outputs, increasing the risk of credential compromise in enterprise environments.
Lower-severity vulnerabilities primarily affect Node.js’s Permission Model and internal APIs. For instance, CVE-2026-48617 and CVE-2026-48935 allow bypassing file system restrictions under certain conditions, while CVE-2026-48936 permits unauthorized local network access via Unix domain sockets despite permission flags. Though classified as low severity, these issues could still be leveraged in chained attacks.
The release also includes fixes for HTTP response queue poisoning (CVE-2026-48931) caused by a race condition in the http. Agent implementation and improper session cleanup in HTTP/2 servers (CVE-2026-48937) could allow continued data processing after connection termination signals.
Alongside vulnerability fixes, Node.js updated several core dependencies, including llhttp (9.4.2), nghttp2 (1.69.0), OpenSSL (3.5.7), and undici across supported versions. These updates address additional upstream security concerns and improve overall runtime stability.
Security experts strongly recommend upgrading to the patched versions immediately, as all supported release lines are affected. Organizations running end-of-life Node.js versions remain at heightened risk, as they do not receive security patches.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
