CVE-2026-48930

score

0.1

cvss

9.8

epss

0.3%

published

2026-06-26

kev added

—

first seen

2026-10-21

Node.js 22, 24, and 26 contain a hostname verification bypass caused by embedded-nul characters leading to silent authority rebinding due to c-string truncation in resolver bindings, letting attackers bypass TLS hostname checks, exploit requires crafted hostname input.