TLS Hostname Handling Flaw in Node.js Products from NodeSource

CVE-2026-48618

What is CVE-2026-48618?

A flaw in the TLS hostname handling of Node.js could lead to authentication bypass via improper normalization of Unicode dot separators. This vulnerability affects all supported versions of Node.js and can compromise the confidentiality of data, allowing attackers to exploit unintended security boundaries in specific configurations. Users are advised to review the security implications and update their installations accordingly to mitigate risks.

References