Bug 2493337 (CVE-2026-48618)

Summary:	CVE-2026-48618 nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	kaycoth, rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2493808, 2493810, 2493811
Bug Blocks:

Description OSIDB Bzimport 2026-06-26 02:02:34 UTC

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Comment 2 errata-xmlrpc 2026-07-06 04:37:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:35841 https://access.redhat.com/errata/RHSA-2026:35841

Comment 3 errata-xmlrpc 2026-07-06 05:16:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:35842 https://access.redhat.com/errata/RHSA-2026:35842

Comment 4 errata-xmlrpc 2026-07-06 14:23:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:35891 https://access.redhat.com/errata/RHSA-2026:35891

Comment 5 errata-xmlrpc 2026-07-06 14:45:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:35892 https://access.redhat.com/errata/RHSA-2026:35892

Comment 6 errata-xmlrpc 2026-07-14 12:31:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:39246 https://access.redhat.com/errata/RHSA-2026:39246

Comment 7 errata-xmlrpc 2026-07-15 11:23:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:39868 https://access.redhat.com/errata/RHSA-2026:39868

Comment 8 errata-xmlrpc 2026-07-20 13:07:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:41947 https://access.redhat.com/errata/RHSA-2026:41947