Loading vulnerability…
Node.js TLS wildcard-depth authentication bypass via Unicode dot separators
CVE-2026-48618 is a TLS hostname-verification vulnerability in Node.js caused by inconsistent normalization of Unicode dot separators between hostname resolution and certificate verification. The mismatch can cause wildcard certificate matching to accept a hostname that should fall outside the wildcard's permitted label depth, bypassing intended TLS endpoint-authentication boundaries. Affected supported release lines include Node.js 22, 24, and 26; distribution advisories also identify affected packages based on older release lines.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass TLS hostname-authentication restrictions and expose confidential information under affected configurations. A connection may be accepted even though the certificate's wildcard scope should not authenticate the intended hostname. Code execution, integrity compromise, and denial of service are not established impacts of this specific vulnerability.
If you can’t patch tonight, do this now.
No vendor-provided workaround is specified. Until updates are deployed, reject unexpected Unicode dot separators in TLS destination hostnames, enforce consistent hostname canonicalization before validation and connection establishment, and restrict outbound TLS destinations to approved endpoints where feasible. Do not rely solely on wildcard-depth hostname restrictions when processing attacker-influenced internationalized hostnames. These measures are defense in depth, not substitutes for patching.
Patch, then assume compromise.
Upgrade Node.js 22.x to 22.23.0 or later, 24.x to 24.17.0 or later, and 26.x to 26.3.1 or later, preferably using the latest vendor-supported maintenance release. For distribution-managed installations, apply the applicable security-fixed packages: Debian 12 fixes are available in 18.20.4+dfsg-1~deb12u3 and Debian 13 fixes in 20.19.2+dfsg-1+deb13u3. Update affected embedded runtimes and buildpacks through their product vendors. Later fixes also address CVE-2026-105483, a separate TLS verification regression introduced after this vulnerability's fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.