Node.js June 2026 Security Release — 12 Vulnerabilities Across 22.x/24.x/26.x Including Two High-Severity TLS Authentication Bypass and WebCrypto DoS Flaws (CVE-2026-48618, CVE-2026-48933)
Node.js June 2026 Security Release (TL-2026-0866), also tracked as Node.js June 2026 Security Releases, is a high-severity software vulnerability, first published 2026-06-19. It has no confirmed attribution, affects OpenJS Foundation Node.js, references 12 CVEs (CVE-2026-48618, CVE-2026-48933, CVE-2026-48615), maps to 16 MITRE ATT&CK techniques (T1005, T1036.005, T1070.006), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0866
- Threat ID
- TL-2026-0866
- Also known as
- Node.js June 2026 Security Releases, Node.js Thursday June 18 2026 Security Releases
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-06-19
- Last reviewed
- 2026-06-19
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, financial, ecommerce, saas, cloud-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
On June 18, 2026 the Node.js project shipped coordinated security releases (v22.23.0 LTS, v24.17.0 LTS, v26.3.1 Current) fixing 12 vulnerabilities, headlined by two High-severity issues: CVE-2026-48618, a Unicode dot-separator TLS hostname-normalization mismatch enabling wildcard-depth authentication bypass, and CVE-2026-48933, a WebCrypto AES integer overflow in subtle.encrypt() causing remote process abort (DoS). The remaining ten span TLS/SNI trust-control bypasses, HTTP/2 memory exhaustion, proxy credential leakage, and Permission Model escapes.
How Node.js June 2026 Security Release works
On Thursday, June 18, 2026 the Node.js project released coordinated security updates across all three supported release lines — v22.23.0 (LTS), v24.17.0 (LTS), and v26.3.1 (Current) — addressing twelve distinct vulnerabilities reported through the project's HackerOne program and bundled dependency upgrades (llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, and undici 6.27.0/7.28.0/8.5.0 per line).
The two High-severity issues anchor the release. CVE-2026-48618 (Unicode Dot-Separator TLS Wildcard-Depth Authentication Bypass) stems from improper handling of Unicode dot separators during TLS hostname verification: the resolver and the certificate verifier normalize hostnames differently, so a hostname containing a Unicode full-stop variant can be matched against a wildcard certificate at a depth the operator never intended, allowing an attacker to satisfy TLS server-identity checks for names they do not legitimately control and undermine the confidentiality of supposedly authenticated channels. CVE-2026-48933 (WebCrypto AES Integer Overflow → Remote Process Abort) is an integer-overflow condition in the WebCrypto subtle.encrypt() implementation that is triggered when the plaintext length is a multiple of 2 GiB; the overflow miscomputes the cipher output buffer length and aborts the process, giving a remote party that can influence WebCrypto input sizes a denial-of-service primitive against a Node.js service.
Six Medium-severity issues follow. CVE-2026-48615 leaks proxy credentials embedded in proxy URLs through the ERR_PROXY_TUNNEL error message, where they can be captured by logs and diagnostics. CVE-2026-48619 lets a malicious HTTP/2 server send an unbounded stream of ORIGIN frames to a node:http2 client, growing the client's originSet without limit until an out-of-memory condition. CVE-2026-48937 (22.x/24.x only) leaves HTTP/2 server sessions un-cleaned after a GOAWAY is sent on an invalid-protocol error, so the server keeps consuming data it should have torn down. CVE-2026-48928 arises from case-sensitive SNI context matching: an uppercase SNI value fails to match the intended TLS context, bypassing mutual-TLS (mTLS) authorization policy in multi-context servers. CVE-2026-48930 allows embedded-NUL hostnames to silently rebind authority via C-string truncation, so a name like "trusted.example.com\u0000.evil.tld" is verified as one authority but connected as another. CVE-2026-48934 permits TLS host-identity verification bypass through session reuse with a different ServerName, letting a reused session skip certificate validation for a host it was never authenticated against.
Four Low-severity issues round out the set, three of them Permission Model escapes. CVE-2026-48617 bypasses the Permission Model via path mis-validation in process.report.writeReport(), writing diagnostic reports outside allowed paths. CVE-2026-48935 lets FileHandle.utimes() in the fs.promises API modify file timestamps on paths granted only read access (--allow-fs-read). CVE-2026-48936 (26.x only) is an incomplete fix for CVE-2026-21636 that still allows starting a local Unix domain socket server without --allow-net. CVE-2026-48931 is a TOCTOU race in http.Agent that enables HTTP response-queue poisoning, where a client accepts a response that was sent before its request was transmitted.
There is no reported active exploitation and no public proof-of-concept for any of the twelve at release time, and the project did not publish CVSS scores. None of the issues involve attacker network infrastructure, malware, or C2 — they are runtime/library defects — so no IOC infrastructure pivot (e.g., BeaconBeagle) applies; the indicators below are version, API-usage, and behavioral detection signals. Operators should upgrade to v22.23.0, v24.17.0, or v26.3.1 and avoid end-of-life lines that will not receive these fixes.
MITRE ATT&CK techniques used in TL-2026-0866
Collection
T1005 Data from Local System; T1557 Adversary-in-the-Middle
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp
Command and Control
Initial Access
T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Credential Access
T1212 Exploitation for Credential Access; T1552.001 Credentials In Files; T1556 Modify Authentication Process; T1557 Adversary-in-the-Middle
defense-impairment
T1222 File and Directory Permissions Modification; T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Impact
T1499.003 Application Exhaustion Flood; T1499.004 Application or System Exploitation
Privilege Escalation
Affected products and versions in Node.js June 2026 Security Release
- OpenJS Foundation — Node.js
Vulnerable versions: 22.x prior to 22.23.0
Fixed in: 22.23.0 - OpenJS Foundation — Node.js
Vulnerable versions: 24.x prior to 24.17.0
Fixed in: 24.17.0 - OpenJS Foundation — Node.js
Vulnerable versions: 26.x prior to 26.3.1
Fixed in: 26.3.1
Remediation for Node.js June 2026 Security Release
Patches
- Node.js v22.23.0 (LTS) — fixes all line-22 applicable CVEs.
- Node.js v24.17.0 (LTS) — fixes all line-24 applicable CVEs.
- Node.js v26.3.1 (Current) — fixes all line-26 applicable CVEs including the 26.x-only CVE-2026-48936.
- Bundled dependency upgrades: llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, undici 6.27.0/7.28.0/8.5.0.
Immediate actions
- Upgrade Node.js to v22.23.0 (LTS), v24.17.0 (LTS), or v26.3.1 (Current) — whichever matches your release line.
- Inventory running Node.js versions across servers, containers, CI runners, and serverless/edge runtimes; flag any 22.x < 22.23.0, 24.x < 24.17.0, or 26.x < 26.3.1.
- Retire end-of-life Node.js lines (e.g. 20.x and earlier) that will not receive these fixes.
Workarounds
- For HTTP/2 clients, constrain or proxy outbound HTTP/2 to trusted servers to limit ORIGIN-frame memory abuse (CVE-2026-48619) until patched.
- Avoid passing attacker-controllable >2 GiB inputs to WebCrypto subtle.encrypt() (CVE-2026-48933).
- Strip credentials from proxy URLs and inject them via dedicated auth headers to limit ERR_PROXY_TUNNEL leakage (CVE-2026-48615).
Longer-term hardening
- Add Node.js runtime version gates to CI/CD so builds fail on known-vulnerable releases.
- Audit application logs and diagnostics pipelines for previously captured proxy credentials (CVE-2026-48615) and rotate any exposed proxy secrets.
- Review multi-context TLS/mTLS server configurations for reliance on SNI case or wildcard-depth assumptions (CVE-2026-48618, CVE-2026-48928).
- Where the Permission Model (--permission) is used as a sandbox boundary, treat it as defense-in-depth, not a sole control, given repeated bypass classes (CVE-2026-48617/48935/48936).
CVEs associated with Node.js June 2026 Security Release
CVE-2026-48618, CVE-2026-48933, CVE-2026-48615, CVE-2026-48619, CVE-2026-48937, CVE-2026-48928, CVE-2026-48930, CVE-2026-48934, CVE-2026-48617, CVE-2026-48935, CVE-2026-48936, CVE-2026-48931
Weaknesses (CWE) in Node.js June 2026 Security Release
CWE-190, CWE-295, CWE-297, CWE-400, CWE-401, CWE-532, CWE-626, CWE-158, CWE-178, CWE-367
Timeline of Node.js June 2026 Security Release
- CVE-2026-21636 (Permission Model network-restriction bypass) previously fixed; its incomplete remediation later resurfaces as CVE-2026-48936 in the 26.x line.
- The releases bundle upgraded dependencies to carry upstream fixes: llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, and undici 6.27.0 (22.23.0) / 7.28.0 (24.17.0) / 8.5.0 (26.3.1).
- Three Permission Model bypasses are fixed by RafaelGSS: CVE-2026-48617 (process.report.writeReport() path mis-validation, reported by 'suul'), CVE-2026-48935 (FileHandle.utimes() write under --allow-fs-read, reported by 'muhammaddaffa'), and CVE-2026-48936 (Unix domain socket server bypassing --permission network restrictions, 26.x only, reported by 'cyberjoker').
- Two HTTP/2 resource-handling flaws are fixed: CVE-2026-48619 (unbounded node:http2 client originSet growth from attacker ORIGIN frames, reported by 'kingsd', fixed by Matteo Collina) and CVE-2026-48937 (HTTP/2 sessions never cleaned up after GOAWAY on invalid-protocol errors, 22.x/24.x only, reported and fixed by Tim Perry).
- A cluster of three Medium-severity TLS trust-control bypasses lands together, all fixed by Matteo Collina: CVE-2026-48928 (uppercase-SNI mTLS authorization bypass, reported by 'tmeletlidis'), CVE-2026-48930 (embedded-NUL hostname authority rebinding, reported by 'tmeletlidis'), and CVE-2026-48934 (TLS host-identity bypass via session reuse with a different ServerName, reported by '3d7omb').
- Two High-severity flaws highlighted: CVE-2026-48618 (TLS Unicode dot-separator wildcard-depth authentication bypass, reported by 'tmeletlidis', fixed by Matteo Collina) and CVE-2026-48933 (WebCrypto AES integer overflow DoS, reported by 'erichen', fixed by Filip Skokan).
- Patched releases shipped simultaneously: v22.23.0 (LTS), v24.17.0 (LTS), and v26.3.1 (Current), released by @aduh95 (Antoine du Hamel), with bundled llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, and undici upgrades.
- Node.js project publishes the 'Thursday, June 18, 2026 Security Releases' advisory disclosing 12 vulnerabilities across the 22.x, 24.x, and 26.x lines.
- Threadlinqs Intelligence ingests the release as TL-2026-0866; no active exploitation or public proof-of-concept reported at time of analysis.
- Security news outlets (Cyber Security News, Cryptika, LinuxCompatible) report the release, summarizing the 2 High, 6 Medium, and 4 Low severity issues and urging upgrades off end-of-life lines.
Sources cited for Node.js June 2026 Security Release
- Node.js — Thursday, June 18, 2026 Security Releases
- Release 2026-06-18, Version 26.3.1 (Current), @aduh95 — nodejs/node
- Node.js — Node.js 22.23.0 (LTS)
- Node.js — Node.js 24.17.0 (LTS)
- Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication Bypasses
- Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication Bypasses — Cryptika Cybersecurity
- Node.js 26.3.1, 24.17.0 LTS, and 22.23.0 LTS Security Updates: Patch TLS and Memory Flaws
- Node.js Security Releases blog index
Threats related to Node.js June 2026 Security Release
- Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including HTTP/2 DoS, Authorization Bypass, and Auth Fail-Open Flaws — NVD Scores 5 of 11 CRITICAL/HIGH Despite Apache's Low/Moderate Ratings
- Node.js Patches 11 Security Flaws Across v22.23.2, v24.18.1, v26.5.1 (HTTP/2 DoS, Permission Model Bypass, TLS/mTLS Issues)
- GitLab Patches 13 Security Flaws (incl. CVE-2026-6267, CVE-2026-12436) Enabling Data Exposure, CI/CD Tampering, and DoS
- CVE-2026-54876 — OpenSSL Client-Side Memory Leak in OCSP Response Checking (Denial of Service)
- OpenSSL "HollowByte" DoS Vulnerability — Memory Exhaustion via Malformed ClientHello (11-Byte Trigger)
- Multiple Zscaler Client Connector Flaws Enable Remote Code Execution (CVE-2026-59568)
Detection coverage for TL-2026-0866
As of 2026-06-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0866 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.