CVE-2026-48933

Overview

Node.js is an asynchronous, event-driven JavaScript runtime designed for building scalable network applications. Since Node.js 15.0.0, its crypto module has included an implementation of the standard Web Crypto API, whose subtle.encrypt() and subtle.decrypt() methods perform AES encryption in Node.js's native C++ layer on top of the bundled OpenSSL.

An integer overflow vulnerability (CVE-2026-48933) has been identified in Node.js's Web Crypto AES implementation. Before encrypting, Node.js works out how large the output buffer must be by adding the cipher's block size and any authentication tag length to the input length. However, it stored that total in a signed 32-bit integer. When the input is a multiple of 2 GiB, the sum overflows, and the process aborts instead of reporting an error. An attacker who can get an application to encrypt a large enough input of their choosing can therefore crash it.

This behaviour maps to CWE-190 (Integer Overflow or Wraparound), where an arithmetic result grows past what its type can hold and wraps to a value the following code does not expect. In Node.js, the wrapped buffer length reaches the allocation and cipher calls, which cannot handle it, and the runtime terminates. NVD also lists CWE-770 (Allocation of Resources Without Limits or Throttling) for this CVE.

Exploitation requires an application that passes attacker-influenced data of about 2 GiB or more to subtle.encrypt() with an AES algorithm. Examples include a service that encrypts uploaded files with Web Crypto without a size limit. No authentication is needed if such an endpoint is public. Applications that cap input sizes well below 2 GiB, or that use the classic crypto.createCipheriv() API instead of Web Crypto, do not reach this code. The Node.js project describes the issue as affecting its supported 22.x, 24.x and 26.x lines. The same unchecked calculation is present in every line since Web Crypto was introduced in 15.0.0.

Details

Module Info

• Product: Node.js
• Affected packages: node (built-in crypto module, Web Crypto API; src/crypto/crypto_aes.cc)
• Affected versions: >=15.0.0 <=21.7.3 >=22.0.0 <22.23.0 >=23.0.0 <=23.11.1 >=24.0.0 <24.17.0 >=25.0.0 <=25.9.0 >=26.0.0 <26.3.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable; Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package
• Fixed in: Node.js 22.23.0, 24.17.0, and 26.3.1 (upstream fixes, released June 18, 2026); Node.js NES v16.20.13 (16.x line), v20.20.3 (20.x line), and the custom builds v20.20.10 and v22.22.10, all shipped June 25, 2026; 16.x and 20.x never received an upstream fix before reaching End-of-Life

Vulnerability Info

This High-severity vulnerability is found in the AES cipher routine of Node.js's Web Crypto implementation (src/crypto/crypto_aes.cc). The Red Hat ADP assigns a CVSS v3.1 score of 7.5, matching the HackerOne CNA's CVSS v3.0 score of 7.5, and the Node.js project also rates it High.

Before calling OpenSSL, the routine is supposed to size its output buffer as the input length plus one block plus the tag length, and refuse anything that does not fit the integer type it uses. In the vulnerable implementation, it computed int buf_len = in.size() + block size + tag length with no range check. For inputs of 2 GiB or more, that value no longer fits in an int, and the wrapped length leads to a process abort. The fix adds a TryGetIntCipherOutputLength() helper that checks the sum against the int range and returns a failed operation instead. It also rejects a negative block size. It shipped as commit 38b4c5ed51 on 22.x, 9e4dfc7bba on 24.x and 98fbc89211 on 26.x, through nodejs-private pull request #878.

An attacker would need to supply, or cause the application to assemble, an input of around 2 GiB to a Web Crypto AES encrypt call. A single such request can bring the process down.

Note: Because the input has to reach about 2 GiB, applications that enforce body or upload size limits below that, which is typical for HTTP servers, are not exposed by this issue.

Mitigation

Node.js 22.x, 24.x and 26.x are supported and are fixed in 22.23.0, 24.17.0 and 26.3.1 and later. Every other release line from 15.x onward is past its support window and never received an upstream fix. Node.js 15.x reached End-of-Life on June 1, 2021; Node.js 16.x on September 11, 2023; Node.js 18.x on April 30, 2025; Node.js 20.x on April 30, 2026; Node.js 21.x on June 1, 2024; Node.js 23.x on June 1, 2025; and Node.js 25.x on June 1, 2026. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Node.js 22.23.0, 24.17.0 or 26.3.1 or later on those lines, all of which include this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines, and cap the size of data passed to subtle.encrypt().
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• erichen (reporter)
• Filip Skokan (remediation developer)