Node.js Patches 12 Flaws Including TLS Authentication Bypass and WebCrypto DoS

The Node.js project released security updates across its supported 22.x, 24.x, and 26.x lines to fix 12 vulnerabilities, including two high-severity issues that prompted calls for immediate patching. The most serious bugs are CVE-2026-48618, a TLS hostname verification flaw caused by improper handling of Unicode dot separators that can lead to authentication bypass, and CVE-2026-48933, a WebCrypto AES integer overflow that can crash processes and enable remote denial-of-service. The releases were announced for all active Node.js lines through the project’s coordinated June security update process and public notices on the oss-sec mailing list.