Node.js June 2026 Security Release — 12 Vulnerabilities Across 22.x/24.x/26.x Including Two High-Severity TLS Authentication Bypass and WebCrypto DoS Flaws (CVE-2026-48618, CVE-2026-48933) — Threadlinqs Intelligence
As of 2026-06-19, Node.js June 2026 Security Release — 12 Vulnerabilities Across 22.x/24.x/26.x Including Two High-Severity TLS Authentication Bypass and WebCrypto DoS Flaws (CVE-2026-48618, CVE-2026-48933) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0866 · Severity: HIGH · Status: PATCHED · Category: VULNERABILITY
On June 18, 2026 the Node.js project shipped coordinated security releases (v22.23.0 LTS, v24.17.0 LTS, v26.3.1 Current) fixing 12 vulnerabilities, headlined by two High-severity issues:
On Thursday, June 18, 2026 the Node.js project released coordinated security updates across all three supported release lines — v22.23.0 (LTS), v24.17.0 (LTS), and v26.3.1 (Current) — addressing twelve distinct vulnerabilities reported through the project's HackerOne program and bundled dependency upgrades (llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, and undici 6.27.0/7.28.0/8.5.0 per line).
The two High-severity issues anchor the release. CVE-2026-48618 (Unicode Dot-Separator TLS Wildcard-Depth Authentication Bypass) stems from improper handling of Unicode dot separators during TLS hostname verification: the resolver and the certificate verifier normalize hostnames differently, so a hostname containing a Unicode full-stop variant can be matched against a wildcard certificate at a depth the operator never intended, allowing an attacker to satisfy TLS server-identity checks for names they do not legitimately control and undermine the confidentiality of supposedly authenticated channels. CVE-2026-48933 (WebCrypto AES Integer Overflow → Remote Process Abort) is an integer-overflow condition in the WebCrypto subtle.encrypt() implementation that is triggered when the plaintext length is a multiple of 2 GiB; the overflow miscomputes the cipher output buffer length and aborts the process, giving a remote party that can influence WebCrypto input sizes a denial-of-service primitive against a Node.js service.
Six Medium-severity issues follow. CVE-2026-48615 leaks proxy credentials embedded in proxy URLs through the ERR_PROXY_TUNNEL error message, where they can be captured by logs and diagnostics. CVE-2026-48619 lets a malicious HTTP/2 server send an unbounded stream of ORIGIN frames to a node:http2 client, growing the client's originSet without limit until an out-of-memory condition. CVE-2026-48937 (22.x/24.x only) leaves HTTP/2 server sessions un-cleaned after a GOAWAY is sent on an invalid-protocol error, so the server keeps consuming data it should have torn down. CVE-2026-48928 arises from case-sensitive SNI context matching: an uppercase SNI value fails to match the intended TLS context, bypassing mutual-TLS (mTLS) authorization policy in multi-context servers. CVE-2026-48930 allows embedded-NUL hostnames to silently rebind authority via C-string truncation, so a name like "trusted.example.com\u0000.evil.tld" is verified as one authority but connected as another. CVE-2026-48934 permits TLS host-identity verification bypass through session reuse with a different ServerName, letting a reused session skip certificate validation for a host it was never authenticated against.
Four Low-severity issues round out the set, three of them Permission Model escapes. CVE-2026-48617 bypasses the Permission Model via path mis-validation in process.report.writeReport(), writing diagnostic reports outside allowed paths. CVE-2026-48935 lets FileHandle.utimes() in the fs.promises API modify file timestamps on paths granted only read access (--allow-fs-read). CVE-2026-48936 (26.x only) is an incomplete fix for CVE-2026-21636 that still allows starting a local Unix domain socket server without --allow-net. CVE-2026-48931 is a TOCTOU race in http.Agent that enables HTTP response-queue poisoning, where a client accepts a response that was sent before its request was transmitted.
There is no reported active exploitation and no public proof-of-concept for any of the twelve at release time, and the project did not publish CVSS scores. None of the issues involve attacker network infrastructure, malware, or C2 — they are runtime/library defects — so no IOC infrastructure pivot (e.g., BeaconBeagle) applies; the indicators below are version, API-usage, and behavioral detection signals. Operators should upgrade to v22.23.0, v24.17.0, or v26.3.1 and avoid end-of-life lines that will not receive these fixes.
Weaknesses (CWE)
CWE-190, CWE-295, CWE-297, CWE-400, CWE-401, CWE-532, CWE-626, CWE-158, CWE-178, CWE-367
Target sectors: technology, software-development, financial, ecommerce, saas, cloud-services
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-48618, CVE-2026-48933, CVE-2026-48615, CVE-2026-48619, CVE-2026-48937, CVE-2026-48928, CVE-2026-48930, CVE-2026-48934, CVE-2026-48617, CVE-2026-48935, T1190, T1557, T1557, T1553, T1556, T1552.001, T1499.004, T1499.003, T1548, T1222