Threat reportVulnerabilityTL-2026-0866
Node.js June 2026 Security Release — 12 Vulnerabilities Across 22.x/24.x/26.x Including Two High-Severity TLS Authentication Bypass and WebCrypto DoS Flaws (CVE-2026-48618, CVE-2026-48933)
On June 18, 2026 the Node.js project shipped coordinated security releases (v22.23.0 LTS, v24.17.0 LTS, v26.3.1 Current) fixing 12 vulnerabilities, headlined by two High-severity issues: CVE-2026-48618, a Unicode dot-separator TLS hostname-normalization mismatch enabling wildcard-depth authentication bypass, and CVE-2026-48933, a WebCrypto AES integer overflow in subtle.encrypt() causing remote process abort (DoS).
Key facts for Node.js June 2026 security releases
Detection coverage for Node.js June 2026 security releases
As of 2026-06-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0866 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Node.js TLS Host-Identity Bypass — Unicode Dot / Embedded-NUL / Uppercase-SNI in Hostname Verification (Exploitation)
Detects the host-identity strings produced by the Node.js June 2026 TLS trust-control bypass cluster (CVE-2026-48618 Unicode dot-separator wildcard-depth bypass, CVE-2026-48930 embedded-NUL authority rebinding, CVE-2026-48928 uppercase/mixed-case SNI mTLS authorization bypass). Hunts application/proxy/TLS-termination logs for hostnames or SNI values containing the fullwidth full stop (U+FF0E), ideographic full stop (U+3002), an embedded NUL before a second authority label, or a case mismatch between the presented SNI and the configured server context. These are adversary-in-the-middle indicators where a name the attacker does not control is matched against a wildcard certificate at an unintended label depth or rebound to a different authority.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1190, T1553, T1557, T1036.005
- Data sources: nodejs:application, tls:termination, proxy:access, Syslog, CommonSecurityLog
- Severity: high
- Confidence: high
Splunk SPL
index=app_logs OR index=tls_logs sourcetype IN ("nodejs:application","tls:termination","proxy:access") (sni=* OR hostname=* OR servername=* OR _raw=*)
| eval host_field=coalesce(sni, hostname, servername)
```Decode raw and field for the Unicode dot-separator variants and embedded NUL used by CVE-2026-48618 / CVE-2026-48930```
| eval has_unicode_dot=if(match(_raw, "\\\\uFF0E") OR match(_raw, "\\\\u3002") OR match(host_field, "\x{FF0E}") OR match(host_field, "\x{3002}"), 1, 0)
| eval has_embedded_nul=if(match(_raw, "\\\\u0000\\.") OR match(_raw, "%00\\.") OR match(host_field, "\x00"), 1, 0)
```CVE-2026-48928: SNI presented in a different case than the configured TLS context name```
| eval has_case_mismatch=if(isnotnull(sni) AND isnotnull(tls_context) AND lower(sni)==lower(tls_context) AND sni!=tls_context, 1, 0)
| where has_unicode_dot=1 OR has_embedded_nul=1 OR has_case_mismatch=1
| eval cve=case(has_unicode_dot=1,"CVE-2026-48618", has_embedded_nul=1,"CVE-2026-48930", has_case_mismatch=1,"CVE-2026-48928")
| stats count min(_time) as first_seen max(_time) as last_seen values(host_field) as hostnames values(cve) as cve_match by src_ip dest_ip host
| where count > 0
| sort - countMicrosoft KQL
let UnicodeDot = dynamic(["\uFF0E", "\u3002"]);
union isfuzzy=true AppEvents, Syslog, CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend HostField = coalesce(column_ifexists("SNI", ""), column_ifexists("Hostname", ""), column_ifexists("ServerName", ""))
| extend RawMsg = coalesce(column_ifexists("SyslogMessage", ""), column_ifexists("Message", ""), tostring(column_ifexists("RawData", "")))
| where RawMsg has_any (UnicodeDot) or HostField has_any (UnicodeDot)
or RawMsg matches regex @"(\\u0000|%00)\."
or RawMsg has_cs "CVE-2026-48928" or RawMsg has_cs "uppercase-SNI"
| extend Cve = case(RawMsg has_any (UnicodeDot) or HostField has_any (UnicodeDot), "CVE-2026-48618",
RawMsg matches regex @"(\\u0000|%00)\.", "CVE-2026-48930",
"CVE-2026-48928")
| project TimeGenerated, Computer, HostField, RawMsg, Cve
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Hosts = make_set(HostField, 50) by Computer, Cve
| sort by Count descSigma
title: Node.js TLS Host-Identity Bypass Hostname Shape (Unicode Dot / Embedded-NUL / Case-Mismatch SNI)
id: 6f1a9c2e-0b44-4d7a-9e21-1c0f48618928
status: experimental
description: Detects TLS SNI/hostname strings consistent with the Node.js June 2026 trust-control bypass cluster (CVE-2026-48618 / CVE-2026-48930 / CVE-2026-48928).
references:
- https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/19
tags:
- attack.defense_evasion
- attack.t1553
- attack.credential_access
- attack.t1557
- attack.t1036.005
- cve.2026.48618
- cve.2026.48930
- cve.2026.48928
logsource:
product: linux
service: application
detection:
unicode_dot:
msg|contains:
- '\uFF0E'
- '\u3002'
embedded_nul:
msg|contains:
- '\u0000.'
- '%00.'
case_marker:
msg|contains: 'uppercase-SNI'
condition: unicode_dot or embedded_nul or case_marker
falsepositives:
- Legitimate internationalized domain names (IDN); validate against an IDNA-normalized allowlist
- Penetration-testing or detection-validation harnesses emitting marker strings
level: highKnown false positives:
- Legitimate internationalized domain names (IDN) containing Unicode dot equivalents
- Detection-validation harnesses emitting benign marker strings
- Multi-context TLS servers with intentional case-insensitive SNI handling
Tuning notes: Maintain an IDNA-normalized allowlist of legitimate internationalized hostnames to suppress IDN false positives. Where TLS termination logs SNI and the matched certificate, alert only when the matched wildcard depth differs from the requested label depth (CVE-2026-48618). Exclude known detection-test source IPs.
- Node.js Vulnerable Runtime Inventory Below June 2026 Security Release (Exploitation Surface) · unlock with TL Creds
- Node.js WebCrypto AES Integer-Overflow Remote Process Abort — SIGABRT Without Stack Unwind (Post-Exploitation / DoS) · unlock with TL Creds
- Node.js HTTP/2 ORIGIN-Frame Memory Exhaustion & TLS Session-Reuse ServerName Mismatch (C2 / Lateral Movement) · unlock with TL Creds
- Node.js TLS Wildcard-Depth / Authority-Rebind Hostname Anomaly (Exploitation, Sigma-Primary) · unlock with TL Creds
- Node.js Proxy Credential Leak via ERR_PROXY_TUNNEL in Logs (Post-Exploitation, Sigma-Primary) · unlock with TL Creds
- Node.js HTTP/2 Post-GOAWAY Session Leak & http.Agent Response-Queue Poisoning (C2 / Lateral Movement, Sigma-Primary) · unlock with TL Creds
- Node.js Permission Model Escape — writeReport Path Mis-Validation, FileHandle.utimes Timestomp, UDS Network Bypass (Post-Exploitation) · unlock with TL Creds
- Node.js Proxy Credential Leak & http.Agent Response-Queue Poisoning / HTTP/2 GOAWAY Session Leak (C2 / Lateral Movement) · unlock with TL Creds
Indicators of compromise for Node.js June 2026 security releases
As of 2026-06-19, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-0866.
How Node.js June 2026 security releases works
The remaining ten span TLS/SNI trust-control bypasses, HTTP/2 memory exhaustion, proxy credential leakage, and Permission Model escapes.
On Thursday, June 18, 2026 the Node.js project released coordinated security updates across all three supported release lines — v22.23.0 (LTS), v24.17.0 (LTS), and v26.3.1 (Current) — addressing twelve distinct vulnerabilities reported through the project's HackerOne program and bundled dependency upgrades (llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, and undici 6.27.0/7.28.0/8.5.0 per line).
The two High-severity issues anchor the release. CVE-2026-48618 (Unicode Dot-Separator TLS Wildcard-Depth Authentication Bypass) stems from improper handling of Unicode dot separators during TLS hostname verification: the resolver and the certificate verifier normalize hostnames differently, so a hostname containing a Unicode full-stop variant can be matched against a wildcard certificate at a depth the operator never intended, allowing an attacker to satisfy TLS server-identity checks for names they do not legitimately control and undermine the confidentiality of supposedly authenticated channels. CVE-2026-48933 (WebCrypto AES Integer Overflow → Remote Process Abort) is an integer-overflow condition in the WebCrypto subtle.encrypt() implementation that is triggered when the plaintext length is a multiple of 2 GiB; the overflow miscomputes the cipher output buffer length and aborts the process, giving a remote party that can influence WebCrypto input sizes a denial-of-service primitive against a Node.js service.
Six Medium-severity issues follow. CVE-2026-48615 leaks proxy credentials embedded in proxy URLs through the ERR_PROXY_TUNNEL error message, where they can be captured by logs and diagnostics. CVE-2026-48619 lets a malicious HTTP/2 server send an unbounded stream of ORIGIN frames to a node:http2 client, growing the client's originSet without limit until an out-of-memory condition. CVE-2026-48937 (22.x/24.x only) leaves HTTP/2 server sessions un-cleaned after a GOAWAY is sent on an invalid-protocol error, so the server keeps consuming data it should have torn down. CVE-2026-48928 arises from case-sensitive SNI context matching: an uppercase SNI value fails to match the intended TLS context, bypassing mutual-TLS (mTLS) authorization policy in multi-context servers. CVE-2026-48930 allows embedded-NUL hostnames to silently rebind authority via C-string truncation, so a name like "trusted.example.com\u0000.evil.tld" is verified as one authority but connected as another. CVE-2026-48934 permits TLS host-identity verification bypass through session reuse with a different ServerName, letting a reused session skip certificate validation for a host it was never authenticated against.
Four Low-severity issues round out the set, three of them Permission Model escapes. CVE-2026-48617 bypasses the Permission Model via path mis-validation in process.report.writeReport(), writing diagnostic reports outside allowed paths. CVE-2026-48935 lets FileHandle.utimes() in the fs.promises API modify file timestamps on paths granted only read access (--allow-fs-read). CVE-2026-48936 (26.x only) is an incomplete fix for CVE-2026-21636 that still allows starting a local Unix domain socket server without --allow-net. CVE-2026-48931 is a TOCTOU race in http.Agent that enables HTTP response-queue poisoning, where a client accepts a response that was sent before its request was transmitted.
There is no reported active exploitation and no public proof-of-concept for any of the twelve at release time, and the project did not publish CVSS scores. None of the issues involve attacker network infrastructure, malware, or C2 — they are runtime/library defects — so no IOC infrastructure pivot (e.g., BeaconBeagle) applies; the indicators below are version, API-usage, and behavioral detection signals. Operators should upgrade to v22.23.0, v24.17.0, or v26.3.1 and avoid end-of-life lines that will not receive these fixes.
MITRE ATT&CK techniques by tactic:
Collection
T1005 Data from Local System; T1557 Adversary-in-the-Middle
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp
Command and Control
Initial Access
T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Credential Access
T1212 Exploitation for Credential Access; T1552.001 Credentials In Files; T1556 Modify Authentication Process; T1557 Adversary-in-the-Middle
defense-impairment
T1222 File and Directory Permissions Modification; T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Impact
T1499.003 Application Exhaustion Flood; T1499.004 Application or System Exploitation
Privilege Escalation
Remediation for Node.js June 2026 security releases
Patches
- Node.js v22.23.0 (LTS) — fixes all line-22 applicable CVEs.
- Node.js v24.17.0 (LTS) — fixes all line-24 applicable CVEs.
- Node.js v26.3.1 (Current) — fixes all line-26 applicable CVEs including the 26.x-only CVE-2026-48936.
- Bundled dependency upgrades: llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, undici 6.27.0/7.28.0/8.5.0.
Immediate actions
- Upgrade Node.js to v22.23.0 (LTS), v24.17.0 (LTS), or v26.3.1 (Current) — whichever matches your release line.
- Inventory running Node.js versions across servers, containers, CI runners, and serverless/edge runtimes; flag any 22.x < 22.23.0, 24.x < 24.17.0, or 26.x < 26.3.1.
- Retire end-of-life Node.js lines (e.g. 20.x and earlier) that will not receive these fixes.
Workarounds
- For HTTP/2 clients, constrain or proxy outbound HTTP/2 to trusted servers to limit ORIGIN-frame memory abuse (CVE-2026-48619) until patched.
- Avoid passing attacker-controllable >2 GiB inputs to WebCrypto subtle.encrypt() (CVE-2026-48933).
- Strip credentials from proxy URLs and inject them via dedicated auth headers to limit ERR_PROXY_TUNNEL leakage (CVE-2026-48615).
Longer-term hardening
- Add Node.js runtime version gates to CI/CD so builds fail on known-vulnerable releases.
- Audit application logs and diagnostics pipelines for previously captured proxy credentials (CVE-2026-48615) and rotate any exposed proxy secrets.
- Review multi-context TLS/mTLS server configurations for reliance on SNI case or wildcard-depth assumptions (CVE-2026-48618, CVE-2026-48928).
- Where the Permission Model (--permission) is used as a sandbox boundary, treat it as defense-in-depth, not a sole control, given repeated bypass classes (CVE-2026-48617/48935/48936).
Affected and fixed versions
- OpenJS Foundation — Node.js
Vulnerable versions: 22.x prior to 22.23.0
Fixed in: 22.23.0 - OpenJS Foundation — Node.js
Vulnerable versions: 24.x prior to 24.17.0
Fixed in: 24.17.0 - OpenJS Foundation — Node.js
Vulnerable versions: 26.x prior to 26.3.1
Fixed in: 26.3.1
Timeline of Node.js June 2026 security releases
- CVE-2026-21636 (Permission Model network-restriction bypass) previously fixed; its incomplete remediation later resurfaces as CVE-2026-48936 in the 26.x line.
- The releases bundle upgraded dependencies to carry upstream fixes: llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, and undici 6.27.0 (22.23.0) / 7.28.0 (24.17.0) / 8.5.0 (26.3.1).
- Three Permission Model bypasses are fixed by RafaelGSS: CVE-2026-48617 (process.report.writeReport() path mis-validation, reported by 'suul'), CVE-2026-48935 (FileHandle.utimes() write under --allow-fs-read, reported by 'muhammaddaffa'), and CVE-2026-48936 (Unix domain socket server bypassing --permission network restrictions, 26.x only, reported by 'cyberjoker').
- Two HTTP/2 resource-handling flaws are fixed: CVE-2026-48619 (unbounded node:http2 client originSet growth from attacker ORIGIN frames, reported by 'kingsd', fixed by Matteo Collina) and CVE-2026-48937 (HTTP/2 sessions never cleaned up after GOAWAY on invalid-protocol errors, 22.x/24.x only, reported and fixed by Tim Perry).
- A cluster of three Medium-severity TLS trust-control bypasses lands together, all fixed by Matteo Collina: CVE-2026-48928 (uppercase-SNI mTLS authorization bypass, reported by 'tmeletlidis'), CVE-2026-48930 (embedded-NUL hostname authority rebinding, reported by 'tmeletlidis'), and CVE-2026-48934 (TLS host-identity bypass via session reuse with a different ServerName, reported by '3d7omb').
- Two High-severity flaws highlighted: CVE-2026-48618 (TLS Unicode dot-separator wildcard-depth authentication bypass, reported by 'tmeletlidis', fixed by Matteo Collina) and CVE-2026-48933 (WebCrypto AES integer overflow DoS, reported by 'erichen', fixed by Filip Skokan).
- Patched releases shipped simultaneously: v22.23.0 (LTS), v24.17.0 (LTS), and v26.3.1 (Current), released by @aduh95 (Antoine du Hamel), with bundled llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, and undici upgrades.
- Node.js project publishes the 'Thursday, June 18, 2026 Security Releases' advisory disclosing 12 vulnerabilities across the 22.x, 24.x, and 26.x lines.
- Threadlinqs Intelligence ingests the release as TL-2026-0866; no active exploitation or public proof-of-concept reported at time of analysis.
- Security news outlets (Cyber Security News, Cryptika, LinuxCompatible) report the release, summarizing the 2 High, 6 Medium, and 4 Low severity issues and urging upgrades off end-of-life lines.
Sources cited for Node.js June 2026 security releases
- Node.js — Thursday, June 18, 2026 Security Releases nodejs.org · Advisory · 2026-06-18
- Node.js — Node.js 22.23.0 (LTS) nodejs.org · Vendor report · 2026-06-18
- Node.js — Node.js 24.17.0 (LTS) nodejs.org · Vendor report · 2026-06-18
- Node.js Security Releases blog index nodejs.org · Vendor report · 2026-06-18
- Release 2026-06-18, Version 26.3.1 (Current), @aduh95 — nodejs/node GitHub · Code repository · 2026-06-18
- Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication Bypasses cybersecuritynews.com · News · 2026-06-19
- Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication Bypasses — Cryptika Cybersecurity cryptika.com · News · 2026-06-19
- Node.js 26.3.1, 24.17.0 LTS, and 22.23.0 LTS Security Updates: Patch TLS and Memory Flaws linuxcompatible.org · News · 2026-06-18
Previous and next in vulnerability
Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.
