Node.js Releases Security Updates for 12 Vulnerabilities, Two Rated High Severity

Node.js has announced critical security updates that address 12 vulnerabilities across its supported release lines. Among these, two high-severity flaws could lead to denial-of-service (DoS) conditions and authentication bypass.

These updates, released on June 18, 2026, affect Node.js versions 22.x, 24.x, and 26.x. The patched versions are now available as v22.23.0, v24.17.0, and v26.3.1.

Node.js Releases Security Updates

The most severe vulnerability, tracked as CVE-2026-48933, affects the WebCrypto API and can trigger a process crash when handling specially crafted input to the subtle.encrypt() function.

Specifically, inputs that are multiples of 2 GiB can cause an integer overflow, leading to a remote DoS condition. This issue is particularly concerning for applications relying heavily on cryptographic operations in untrusted environments.

Another high-severity flaw, CVE-2026-48618, impacts TLS hostname verification. Improper handling of Unicode dot separators can result in a mismatch between hostname resolution and certificate validation, enabling attackers to bypass TLS wildcard authentication under certain configurations. This could allow unauthorized access or compromise data confidentiality.

In addition to the high-severity issues, several medium-severity vulnerabilities affect HTTP/2, TLS, and proxy handling mechanisms. Notably, CVE-2026-48619 allows attackers to exploit HTTP/2 clients by sending excessive ORIGIN frames, leading to unbounded memory consumption and potential service disruption.

Similarly, CVE-2026-48934 enables TLS host identity verification bypass via session reuse with mismatched server names, posing a risk to secure communications.

Another notable issue, CVE-2026-48615, exposes proxy credentials through error messages when using proxy tunneling. If credentials are embedded in proxy URLs, they may be leaked via logs or diagnostic outputs, increasing the risk of credential compromise in enterprise environments.

Lower-severity vulnerabilities primarily affect Node.js’s Permission Model and internal APIs. For instance, CVE-2026-48617 and CVE-2026-48935 allow bypassing file system restrictions under certain conditions, while CVE-2026-48936 permits unauthorized local network access via Unix domain sockets despite permission flags. Though classified as low severity, these issues could still be leveraged in chained attacks.

The release also includes fixes for HTTP response queue poisoning (CVE-2026-48931) caused by a race condition in the http. Agent implementation and improper session cleanup in HTTP/2 servers (CVE-2026-48937) could allow continued data processing after connection termination signals.

CVE ID	Title / Short Description	Severity	Affected Release Lines
CVE-2026-48933	WebCrypto AES integer overflow leads to remote process abort (DoS)	High	Node.js 22, 24, 26
CVE-2026-48618	Unicode dot separator handling allows TLS wildcard-depth authentication bypass	High	Node.js 22, 24, 26
CVE-2026-48615	Proxy credentials leaked in ERR_PROXY_TUNNEL error message	Medium	Node.js 22, 24, 26
CVE-2026-48617	Permission model bypass via process.report.writeReport() path misvalidation	Low	Node.js 22, 24, 26
CVE-2026-48619	Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames	Medium	Node.js 22, 24, 26
CVE-2026-48937	HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors	Medium	Node.js 22, 24
CVE-2026-48928	Uppercase SNI context matching can lead to mTLS authorization bypass due to case-sensitive hostname matching	Medium	Node.js 22, 24, 26
CVE-2026-48930	Embedded-NUL hostnames cause silent authority rebinding due to C-string truncation in resolver bindings	Medium	Node.js 22, 24, 26
CVE-2026-48934	TLS host identity verification bypass via session reuse with different servername	Medium	Node.js 22, 24, 26
CVE-2026-48935	Permission model bypass via FileHandle.utimes() in the promises API	Low	Node.js 22, 24, 26
CVE-2026-48936	Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)	Low	Node.js 26 only
CVE-2026-48931	HTTP response queue poisoning via TOCTOU race condition in http.Agent	Low	Node.js 22, 24, 26

Alongside vulnerability fixes, Node.js updated several core dependencies, including llhttp (9.4.2), nghttp2 (1.69.0), OpenSSL (3.5.7), and undici across supported versions. These updates address additional upstream security concerns and improve overall runtime stability.

Security experts strongly recommend upgrading to the patched versions immediately, as all supported release lines are affected. Organizations running end-of-life Node.js versions remain at heightened risk, as they do not receive security patches.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.