---
id: CVE-2026-48934
title: "A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
summary: "A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-295
published: '2026-06-26'
updated: '2026-06-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48934'
references:
  - url: 'https://nodejs.org/en/blog/vulnerability/june-2026-security-releases'
    label: support@hackerone.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48934.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-48934'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2493332'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-48934'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48934'
  - url: 'https://access.redhat.com/errata/RHSA-2026:39246'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35842'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35841'
  - url: 'https://access.redhat.com/errata/RHSA-2026:41947'
  - url: 'https://access.redhat.com/errata/RHSA-2026:39868'
  - url: 'https://access.redhat.com/errata/RHSA-2026:52399'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35892'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35891'
  - url: 'https://access.redhat.com/errata/RHSA-2026:9455'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35272'
  - url: 'https://access.redhat.com/errata/RHSA-2026:34478'
  - url: 'https://access.redhat.com/errata/RHSA-2026:7378'
  - url: 'https://access.redhat.com/errata/RHSA-2026:33866'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00258
epssPercentile: 0.17319
ingestedAt: '2026-06-29T14:29:18.115Z'
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - enterprise_linux 10
  - enterprise_linux 9
  - enterprise_linux_appstream_eus_v_10_0
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_8
  - enterprise_linux_appstream_eus_v_9_6
  - enterprise_linux_appstream_v_9
  - hardened_images
patched:
  - enterprise_linux_appstream_eus_v_10_0
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_8
  - enterprise_linux_appstream_eus_v_9_6
  - enterprise_linux_appstream_v_9
  - hardened_images
---

## Overview

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:39246** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-07-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:39246)
- **RHSA-2026:35842** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35842)
- **RHSA-2026:35841** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35841)
- **RHSA-2026:41947** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41947)
- **RHSA-2026:39868** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:39868)
- **RHSA-2026:52399** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52399)
- **RHSA-2026:35892** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35892)
- **RHSA-2026:35891** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35891)
- **RHSA-2026:9455** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:9455)
- **RHSA-2026:35272** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:35272)
- **RHSA-2026:34478** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34478)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48934.json)