IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.7Yüksek

CVE-2026-48618

nodejs node; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8 Yayım: (4 ay önce)

Açıklama

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Zayıflık türü (CWE): CWE-176CWE-289

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
nodejs node 22.22.3 – ≤ 22.22.3, 24.16.0 – ≤ 24.16.0, 26.3.0 – ≤ 26.3.0
nodejs node.js 22.22.3
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Hardened Images all versions

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (3)
  • cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*

Aynı üründe son açıklar — Node.js

6.5Orta
CVE-2026-105481
nodejs node

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected …

7.4Yüksek
CVE-2026-105482
nodejs node

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. B…

7.4Yüksek
CVE-2026-105483
nodejs node

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIde…

7.4Yüksek
CVE-2026-106069
nodejs node

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.chec…

3.6Düşük
CVE-2026-106071
nodejs node

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops…

3.3Düşük
CVE-2026-106073
nodejs node

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--p…