CVE-2026-48930 is a flaw in Node.js TLS hostname handling where embedded nul bytes cause C string truncation, so a name can silently resolve to a different authority. NVD scores it 9.8, while the Node.js project rates it medium. Update to 22.23.0, 24.17.0 or 26.3.1.
What's affected
All supported release lines: Node.js 22, 24 and 26. The June 2026 security release names Node.js v22.23.0, v24.17.0 and v26.3.1 as the updated versions.
Node.js rates this particular issue medium, and the NVD score is 9.8. The same release fixes other TLS issues such as CVE-2026-48618 and CVE-2026-48934, plus several dependency updates, so it is worth taking in full.
How to check if you're exposed
Read the Node.js version on servers, build agents and in container images.
node --version
docker run --rm node:22 node --version
Check base images and any runtime bundled into products, such as desktop apps and serverless runtimes, since they carry their own Node.js.
What to do now
- Update Node.js to 22.23.0, 24.17.0, 26.3.1 or later in your line.
- Rebuild container images from updated base images and redeploy.
- Check vendors of bundled Node.js runtimes for their own updates.
- Validate and normalize hostnames in application code before handing them to TLS or HTTP clients, and reject names that contain control characters.
Why it matters
The record's class is CWE-284, improper access control, and the description says embedded nul hostnames can lead to silent authority rebinding due to C string truncation in resolver bindings. In plain terms, native code that reads a string up to the first nul byte can see a shorter name than the JavaScript code checked, so the name that is verified and the name that is contacted can differ.
That gap is the same pattern behind several TLS identity issues in this release. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Node.js has not published exploit details in the release post, and neither do we.
Paste your lockfile or manifest into the free in-browser dependency scan to see whether a vulnerable Node.js runtime in your images is in your tree, including as a transitive dependency. Reachability analysis can then show whether your code calls the affected path, which helps you order the work.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the two scores differ so much?
NVD scores the worst case of the vector. The Node.js team weighed the conditions needed. Update either way, because the release is a bundle of fixes.
Sources
Last reviewed: 19 October 2026.
