{
  "threat_severity" : "Moderate",
  "public_date" : "2026-06-26T01:14:36Z",
  "bugzilla" : {
    "description" : "Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency",
    "id" : "2493333",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2493333"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.2",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-289",
  "details" : [ "A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS (mutual Transport Layer Security) setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive information or integrity compromise within the affected system." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:35841",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "nodejs24-1:24.18.0-1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:35842",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "nodejs22-1:22.23.1-2.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:39868",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "nodejs:24-8100020260630152626.6d880403"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:41947",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "nodejs:22-8100020260703140402.6d880403"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:35891",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nodejs:24-9080020260626074955.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:35892",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nodejs:22-9080020260626075442.rhel9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-30T00:00:00Z",
    "advisory" : "RHSA-2026:33866",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs26-main-26.4.0-1.3.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:34478",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs24-main-24.18.0-0.2.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-03T00:00:00Z",
    "advisory" : "RHSA-2026:35272",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs22-main-22.23.1-2.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-04-10T00:00:00Z",
    "advisory" : "RHSA-2026:7378",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs25-main-25.9.0-1.1.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9455",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs20-main-20.20.2-1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "nodejs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-48928\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48928\nhttps://nodejs.org/en/blog/vulnerability/june-2026-security-releases" ],
  "name" : "CVE-2026-48928",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}