Node.js Vulnerability in WebCrypto Implementation Effecting Multiple Versions
CVE-2026-48933

7.5HIGH

Key Information:

Vendor

Nodejs

Status
Node
Vendor
CVE Published:
26 June 2026

What is CVE-2026-48933?

A significant flaw in the WebCrypto implementation of Node.js can lead to a crash when the input for the subtle.encrypt() function exceeds 2GiB. This vulnerability affects all current release lines, namely Node.js versions 22, 24, and 26. Developers must be aware of this issue to prevent potential downtime and protect application integrity.

Affected Version(s)

node 22.22.3

node 24.16.0

node 26.3.0

References

https://nodejs.org/en/blog/vulnerability/june-2026-securi...

CVSS V3.0

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.