Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-26T01:14:36 nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CWE-289

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact.

This Important flaw in Node.js allows for a TLS wildcard-depth authentication bypass due to a mismatch in how hostnames and unicode dot separators are handled during authentication. This could enable an attacker to circumvent security boundaries, potentially leading to unauthorized access and compromise of sensitive information in applications utilizing Node.js for TLS connections. The issue affects Node.js versions 22, 24, and 26 as shipped in Red Hat products. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 2026-07-06T00:00:00Z RHSA-2026:35841 nodejs24-1:24.18.0-1.el10_2 Red Hat Enterprise Linux 10 2026-07-06T00:00:00Z RHSA-2026:35842 nodejs22-1:22.23.1-2.el10_2 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-07-14T00:00:00Z RHSA-2026:39246 nodejs22-1:22.23.1-2.el10_0 Red Hat Enterprise Linux 8 2026-07-15T00:00:00Z RHSA-2026:39868 nodejs:24-8100020260630152626.6d880403 Red Hat Enterprise Linux 9 2026-07-06T00:00:00Z RHSA-2026:35891 nodejs:24-9080020260626074955.rhel9 Red Hat Enterprise Linux 9 2026-07-06T00:00:00Z RHSA-2026:35892 nodejs:22-9080020260626075442.rhel9 Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:28727 nodejs22-main-22.23.1-1.hum1 Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:29012 nodejs24-main-24.18.0-0.1.hum1 Red Hat Hardened Images 2026-06-25T00:00:00Z RHSA-2026:30172 nodejs26-main-26.4.0-1.2.hum1 Red Hat Hardened Images 2026-04-10T00:00:00Z RHSA-2026:7378 nodejs25-main-25.9.0-1.1.hum1 Red Hat Hardened Images 2026-04-21T00:00:00Z RHSA-2026:9455 nodejs20-main-20.20.2-1.hum1 Red Hat Enterprise Linux 8 Affected nodejs:22/nodejs https://www.cve.org/CVERecord?id=CVE-2026-48618 https://nvd.nist.gov/vuln/detail/CVE-2026-48618 https://nodejs.org/en/blog/vulnerability/june-2026-security-releases