TLS Hostname Handling Vulnerability in Node.js Products

CVE-2026-48930

What is CVE-2026-48930?

A vulnerability in Node.js impacting TLS hostname handling has been identified. Specifically, the use of embedded-null characters in hostnames can trigger silent authority rebinding due to c-string truncation within resolver bindings. This issue impacts all supported Node.js release lines, which include Node.js 22, Node.js 24, and Node.js 26, posing potential risks to applications relying on proper hostname validation and secure communications.

References