# Node.js June 2026 Security Release — 12 Vulnerabilities Across 22.x/24.x/26.x Including Two High-Severity TLS Authentication Bypass and WebCrypto DoS Flaws (CVE-2026-48618, CVE-2026-48933)

> On June 18, 2026 the Node.js project shipped coordinated security releases (v22.23.0 LTS, v24.17.0 LTS, v26.3.1 Current) fixing 12 vulnerabilities, headlined by two High-severity issues: CVE-2026-48618, a Unicode dot-separator TLS hostname-normalization mismatch enabling wildcard-depth authentication bypass, and CVE-2026-48933, a WebCrypto AES integer overflow in subtle.encrypt() causing remote process abort (DoS). The remaining ten span TLS/SNI trust-control bypasses, HTTP/2 memory exhaustion, proxy credential leakage, and Permission Model escapes.

- **Published:** 2026-06-19T00:00:00Z
- **Last reviewed:** 2026-06-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0866
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-node-js-june-2026-security-releases-tl-2026-0866.webp?v=21a3d036 (Threadlinqs threat intel: Node.js June 2026 security releases (TL-2026-0866) — High severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-0866
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 15
- **CVEs:** CVE-2026-48618, CVE-2026-48933, CVE-2026-48615, CVE-2026-48619, CVE-2026-48937, CVE-2026-48928, CVE-2026-48930, CVE-2026-48934, CVE-2026-48617, CVE-2026-48935, CVE-2026-48936, CVE-2026-48931, CVE-2026-21636

## Description

On Thursday, June 18, 2026 the Node.js project released coordinated security updates across all three supported release lines — v22.23.0 (LTS), v24.17.0 (LTS), and v26.3.1 (Current) — addressing twelve distinct vulnerabilities reported through the project's HackerOne program and bundled dependency upgrades (llhttp 9.4.2, nghttp2 1.69.0, OpenSSL 3.5.7, and undici 6.27.0/7.28.0/8.5.0 per line).

The two High-severity issues anchor the release. CVE-2026-48618 (Unicode Dot-Separator TLS Wildcard-Depth Authentication Bypass) stems from improper handling of Unicode dot separators during TLS hostname verification: the resolver and the certificate verifier normalize hostnames differently, so a hostname containing a Unicode full-stop variant can be matched against a wildcard certificate at a depth the operator never intended, allowing an attacker to satisfy TLS server-identity checks for names they do not legitimately control and undermine the confidentiality of supposedly authenticated channels. CVE-2026-48933 (WebCrypto AES Integer Overflow → Remote Process Abort) is an integer-overflow condition in the WebCrypto subtle.encrypt() implementation that is triggered when the plaintext length is a multiple of 2 GiB; the overflow miscomputes the cipher output buffer length and aborts the process, giving a remote party that can influence WebCrypto input sizes a denial-of-service primitive against a Node.js service.

Six Medium-severity issues follow. CVE-2026-48615 leaks proxy credentials embedded in proxy URLs through the ERR_PROXY_TUNNEL error message, where they can be captured by logs and diagnostics. CVE-2026-48619 lets a malicious HTTP/2 server send an unbounded stream of ORIGIN frames to a node:http2 client, growing the client's originSet without limit until an out-of-memory condition. CVE-2026-48937 (22.x/24.x only) leaves HTTP/2 server sessions un-cleaned after a GOAWAY is sent on an invalid-protocol error, so the server keeps consuming data it should have torn down. CVE-2026-48928 arises from case-sensitive SNI context matching: an uppercase SNI value fails to match the intended TLS context, bypassing mutual-TLS (mTLS) authorization policy in multi-context servers. CVE-2026-48930 allows embedded-NUL hostnames to silently rebind authority via C-string truncation, so a name like "trusted.example.com\u0000.evil.tld" is verified as one authority but connected as another. CVE-2026-48934 permits TLS host-identity verification bypass through session reuse with a different ServerName, letting a reused session skip certificate validation for a host it was never authenticated against.

Four Low-severity issues round out the set, three of them Permission Model escapes. CVE-2026-48617 bypasses the Permission Model via path mis-validation in process.report.writeReport(), writing diagnostic reports outside allowed paths. CVE-2026-48935 lets FileHandle.utimes() in the fs.promises API modify file timestamps on paths granted only read access (--allow-fs-read). CVE-2026-48936 (26.x only) is an incomplete fix for CVE-2026-21636 that still allows starting a local Unix domain socket server without --allow-net. CVE-2026-48931 is a TOCTOU race in http.Agent that enables HTTP response-queue poisoning, where a client accepts a response that was sent before its request was transmitted.

There is no reported active exploitation and no public proof-of-concept for any of the twelve at release time, and the project did not publish CVSS scores. None of the issues involve attacker network infrastructure, malware, or C2 — they are runtime/library defects — so no IOC infrastructure pivot (e.g., BeaconBeagle) applies; the indicators below are version, API-usage, and behavioral detection signals. Operators should upgrade to v22.23.0, v24.17.0, or v26.3.1 and avoid end-of-life lines that will not receive these fixes.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1557 Adversary-in-the-Middle
- T1557 Adversary-in-the-Middle
- T1553 Subvert Trust Controls
- T1556 Modify Authentication Process
- T1552.001 Credentials In Files
- T1499.004 Application or System Exploitation
- T1499.003 Application Exhaustion Flood
- T1548 Abuse Elevation Control Mechanism
- T1222 File and Directory Permissions Modification
- T1685 Disable or Modify Tools
- T1071.001 Web Protocols
- T1005 Data from Local System
- T1070.006 Timestomp
- T1036.005 Match Legitimate Resource Name or Location
- T1212 Exploitation for Credential Access
- T1199 Trusted Relationship

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Node.js TLS Host-Identity Bypass — Unicode Dot / Embedded-NUL / Uppercase-SNI in Hostname Verification (Exploitation)** (`TL-2026-0866-SPL-001`)

Detects the host-identity strings produced by the Node.js June 2026 TLS trust-control bypass cluster (CVE-2026-48618 Unicode dot-separator wildcard-depth bypass, CVE-2026-48930 embedded-NUL authority rebinding, CVE-2026-48928 uppercase/mixed-case SNI mTLS authorization bypass). Hunts application/proxy/TLS-termination logs for hostnames or SNI values containing the fullwidth full stop (U+FF0E), ideographic full stop (U+3002), an embedded NUL before a second authority label, or a case mismatch between the presented SNI and the configured server context. These are adversary-in-the-middle indicators where a name the attacker does not control is matched against a wildcard certificate at an unintended label depth or rebound to a different authority.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1553, T1557, T1036.005
- **Data sources:** nodejs:application, tls:termination, proxy:access, Syslog, CommonSecurityLog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=app_logs OR index=tls_logs sourcetype IN ("nodejs:application","tls:termination","proxy:access") (sni=* OR hostname=* OR servername=* OR _raw=*)
| eval host_field=coalesce(sni, hostname, servername)
```Decode raw and field for the Unicode dot-separator variants and embedded NUL used by CVE-2026-48618 / CVE-2026-48930```
| eval has_unicode_dot=if(match(_raw, "\\\\uFF0E") OR match(_raw, "\\\\u3002") OR match(host_field, "\x{FF0E}") OR match(host_field, "\x{3002}"), 1, 0)
| eval has_embedded_nul=if(match(_raw, "\\\\u0000\\.") OR match(_raw, "%00\\.") OR match(host_field, "\x00"), 1, 0)
```CVE-2026-48928: SNI presented in a different case than the configured TLS context name```
| eval has_case_mismatch=if(isnotnull(sni) AND isnotnull(tls_context) AND lower(sni)==lower(tls_context) AND sni!=tls_context, 1, 0)
| where has_unicode_dot=1 OR has_embedded_nul=1 OR has_case_mismatch=1
| eval cve=case(has_unicode_dot=1,"CVE-2026-48618", has_embedded_nul=1,"CVE-2026-48930", has_case_mismatch=1,"CVE-2026-48928")
| stats count min(_time) as first_seen max(_time) as last_seen values(host_field) as hostnames values(cve) as cve_match by src_ip dest_ip host
| where count > 0
| sort - count
````

### Microsoft KQL

```kql
let UnicodeDot = dynamic(["\uFF0E", "\u3002"]);
union isfuzzy=true AppEvents, Syslog, CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend HostField = coalesce(column_ifexists("SNI", ""), column_ifexists("Hostname", ""), column_ifexists("ServerName", ""))
| extend RawMsg = coalesce(column_ifexists("SyslogMessage", ""), column_ifexists("Message", ""), tostring(column_ifexists("RawData", "")))
| where RawMsg has_any (UnicodeDot) or HostField has_any (UnicodeDot)
    or RawMsg matches regex @"(\\u0000|%00)\."
    or RawMsg has_cs "CVE-2026-48928" or RawMsg has_cs "uppercase-SNI"
| extend Cve = case(RawMsg has_any (UnicodeDot) or HostField has_any (UnicodeDot), "CVE-2026-48618",
                    RawMsg matches regex @"(\\u0000|%00)\.", "CVE-2026-48930",
                    "CVE-2026-48928")
| project TimeGenerated, Computer, HostField, RawMsg, Cve
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Hosts = make_set(HostField, 50) by Computer, Cve
| sort by Count desc
```

### Sigma

```yaml
title: Node.js TLS Host-Identity Bypass Hostname Shape (Unicode Dot / Embedded-NUL / Case-Mismatch SNI)
id: 6f1a9c2e-0b44-4d7a-9e21-1c0f48618928
status: experimental
description: Detects TLS SNI/hostname strings consistent with the Node.js June 2026 trust-control bypass cluster (CVE-2026-48618 / CVE-2026-48930 / CVE-2026-48928).
references:
    - https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/19
tags:
    - attack.defense_evasion
    - attack.t1553
    - attack.credential_access
    - attack.t1557
    - attack.t1036.005
    - cve.2026.48618
    - cve.2026.48930
    - cve.2026.48928
logsource:
    product: linux
    service: application
detection:
    unicode_dot:
        msg|contains:
            - '\uFF0E'
            - '\u3002'
    embedded_nul:
        msg|contains:
            - '\u0000.'
            - '%00.'
    case_marker:
        msg|contains: 'uppercase-SNI'
    condition: unicode_dot or embedded_nul or case_marker
falsepositives:
    - Legitimate internationalized domain names (IDN); validate against an IDNA-normalized allowlist
    - Penetration-testing or detection-validation harnesses emitting marker strings
level: high
```

**Known false positives:**

- Legitimate internationalized domain names (IDN) containing Unicode dot equivalents
- Detection-validation harnesses emitting benign marker strings
- Multi-context TLS servers with intentional case-insensitive SNI handling

**Tuning notes:** Maintain an IDNA-normalized allowlist of legitimate internationalized hostnames to suppress IDN false positives. Where TLS termination logs SNI and the matched certificate, alert only when the matched wildcard depth differs from the requested label depth (CVE-2026-48618). Exclude known detection-test source IPs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Node.js Vulnerable Runtime Inventory Below June 2026 Security Release (Exploitation Surface) (locked: unlock with TL Creds)
- Node.js WebCrypto AES Integer-Overflow Remote Process Abort — SIGABRT Without Stack Unwind (Post-Exploitation / DoS) (locked: unlock with TL Creds)
- Node.js HTTP/2 ORIGIN-Frame Memory Exhaustion & TLS Session-Reuse ServerName Mismatch (C2 / Lateral Movement) (locked: unlock with TL Creds)
- Node.js TLS Wildcard-Depth / Authority-Rebind Hostname Anomaly (Exploitation, Sigma-Primary) (locked: unlock with TL Creds)
- Node.js Proxy Credential Leak via ERR_PROXY_TUNNEL in Logs (Post-Exploitation, Sigma-Primary) (locked: unlock with TL Creds)
- Node.js HTTP/2 Post-GOAWAY Session Leak & http.Agent Response-Queue Poisoning (C2 / Lateral Movement, Sigma-Primary) (locked: unlock with TL Creds)
- Node.js Permission Model Escape — writeReport Path Mis-Validation, FileHandle.utimes Timestomp, UDS Network Bypass (Post-Exploitation) (locked: unlock with TL Creds)
- Node.js Proxy Credential Leak & http.Agent Response-Queue Poisoning / HTTP/2 GOAWAY Session Leak (C2 / Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Node.js — Thursday, June 18, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)
- [Release 2026-06-18, Version 26.3.1 (Current), @aduh95 — nodejs/node](https://github.com/nodejs/node/releases/tag/v26.3.1)
- [Node.js — Node.js 22.23.0 (LTS)](https://nodejs.org/en/blog/release/v22.23.0)
- [Node.js — Node.js 24.17.0 (LTS)](https://nodejs.org/en/blog/release/v24.17.0)
- [Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication Bypasses](https://cybersecuritynews.com/node-js-patches-12-vulnerabilities/)
- [Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication Bypasses — Cryptika Cybersecurity](https://www.cryptika.com/node-js-fixes-12-vulnerabilities-including-2-high-severity-authentication-bypasses/)
- [Node.js 26.3.1, 24.17.0 LTS, and 22.23.0 LTS Security Updates: Patch TLS and Memory Flaws](https://www.linuxcompatible.org/story/nodejs-2631-24170-lts-and-22230-lts-security-updates-patch-tls-and-memory-flaws-across-all)
- [Node.js Security Releases blog index](https://nodejs.org/en/blog/vulnerability)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0866