CVE-2026-48928

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development.

An inconsistency in Node.js's hostname matching for TLS Server Name Indication (SNI) can cause a trust-policy bypass in multi-context mutual-TLS (mTLS) setups (CVE-2026-48928). A single Node.js TLS server can multiplex several distinct security contexts on one listener, each bound to a hostname and each with its own client-certificate trust policy (commonly via tls.Server's SNI callback). Node.js's matching of an incoming request's SNI hostname to the correct context does not consistently account for letter case: a hostname containing uppercase characters can be matched to the wrong per-hostname context, so a connection intended to be evaluated under one context's mTLS trust policy is instead evaluated under a different context's policy.

This issue affects the Node.js 22, 24, and 26 release lines.

Details

Module Info

• Product: Node.js
• Affected packages: node (the vulnerability is in Node.js's own built-in TLS SNI-context matching, not a bundled third-party dependency)
• Affected versions: <=22.22.3; <=24.16.0; <=26.3.0
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Official Node.js distributions (not published to a package registry)
• Fixed in: Node.js NES v12.22.19, v14.21.12, v16.20.13, v18.20.18, and v20.20.3 (all June 25, 2026). Fixed upstream in Node.js 22.23.0, 24.17.0, and 26.3.1 (June 18, 2026).

Vulnerability Info

This Medium-severity vulnerability is found in Node.js's built-in TLS module, in the code path that selects a security context for an incoming connection based on the client-supplied SNI hostname.

In a multi-context TLS deployment, each hostname is expected to be routed to exactly the security context configured for it, so that context's own client-certificate (mTLS) trust policy is the one enforced for that connection. Hostname comparison for this routing is expected to be case-insensitive, matching how hostnames are compared everywhere else in DNS and TLS.

Because Node.js's SNI-to-context matching does not apply that case-insensitivity consistently, a client that requests a hostname using uppercase letters can, in some configurations, be matched against the wrong context. Depending on how the affected application configured its contexts, this can let a connection be evaluated under a laxer client-certificate trust policy than the one actually intended for that hostname, amounting to an Improper Access Control (CWE-284) bypass of the mTLS trust boundary.

Note: exploitation depends on an application-specific multi-context mTLS configuration where per-hostname trust policies genuinely differ; a single-context TLS server is not affected.

Mitigation

Officially, this issue affects the currently supported Node.js 22, 24, and 26 release lines, all of which have patched releases available (22.23.0, 24.17.0, 26.3.1).

Node.js 12 reached End-of-Life on April 30, 2022; Node.js 14 reached End-of-Life on April 30, 2023; Node.js 16 reached End-of-Life on September 11, 2023; and Node.js 18 reached End-of-Life on April 30, 2025. For more information see previous releases.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a supported Node.js release (22.23.0, 24.17.0, 26.3.1, or later).
• Migrate affected applications away from the End-of-Life Node.js release line(s).
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• tmeletlidis (reporter, per Node.js's official June 2026 security advisory)
• Matteo Collina (remediation developer, per the Node.js June 2026 security release notes)