Loading vulnerability…
Denial of Service in Node.js WebCrypto subtle.encrypt()
CVE-2026-48933 is a denial-of-service vulnerability in the Node.js WebCrypto implementation. Calling subtle.encrypt() with input whose size is a multiple of 2 GiB can crash the Node.js process. Affected supported release lines include Node.js 22, 24, and 26; security updates also address affected older distribution-maintained packages. Exploitation depends on an application allowing attacker-influenced input to reach the vulnerable encryption operation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation terminates the affected Node.js process, interrupting applications and requests handled by that process. Repeated triggering could cause recurring service disruption. The documented impact is availability loss; confidentiality compromise, integrity compromise, and code execution are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vendor-documented workaround is identified. As an interim application-level measure, enforce an input-size limit below 2 GiB before passing untrusted data to subtle.encrypt(), and prevent callers from bypassing that validation. Restrict access to affected encryption functionality where feasible. These measures do not replace installing the security update.
Patch, then assume compromise.
Upgrade Node.js 22.x to 22.23.0 or later, 24.x to 24.17.0 or later, or 26.x to 26.3.1 or later. For distribution-managed installations, apply the vendor security-fixed packages rather than relying solely on upstream version comparisons. Debian 12 fixes are available in 18.20.4+dfsg-1~deb12u3, and Debian 13 fixes are available in 20.19.2+dfsg-1+deb13u3. Update bundled Node.js runtimes through the corresponding product or buildpack security release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.