{
  "threat_severity" : "Moderate",
  "public_date" : "2026-06-26T01:14:37Z",
  "bugzilla" : {
    "description" : "nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling",
    "id" : "2493326",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2493326"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.6",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-170",
  "details" : [ "A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "A flaw was found in Node.js. This vulnerability in the TLS (Transport Layer Security) hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose sensitive information." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:35841",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "nodejs24-1:24.18.0-1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:35842",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "nodejs22-1:22.23.1-2.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:39868",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "nodejs:24-8100020260630152626.6d880403"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:41947",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "nodejs:22-8100020260703140402.6d880403"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:35891",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nodejs:24-9080020260626074955.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:35892",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nodejs:22-9080020260626075442.rhel9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-30T00:00:00Z",
    "advisory" : "RHSA-2026:33866",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs26-main-26.4.0-1.3.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:34478",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs24-main-24.18.0-0.2.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-03T00:00:00Z",
    "advisory" : "RHSA-2026:35272",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs22-main-22.23.1-2.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-04-10T00:00:00Z",
    "advisory" : "RHSA-2026:7378",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs25-main-25.9.0-1.1.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9455",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs20-main-20.20.2-1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "nodejs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-48930\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48930\nhttps://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e\nhttps://hackerone.com/reports/3656716\nhttps://nodejs.org/en/blog/vulnerability/june-2026-security-releases" ],
  "name" : "CVE-2026-48930",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}