CVE-2026-48930

The error results from C-string truncation in resolver bindings — libraries handling C-style character strings treat the NUL byte (\0) as the end of the string. If an attacker can influence the hostname value containing an embedded NUL byte, the portion of the name after that byte is omitted during TLS verification. As a result, the server identity verification mechanism (hostname validation) may accept a certificate not corresponding to the actual target host, leading to silent redirection of the connection to a different authority without the application's knowledge.

An attacker can cause TLS server identity verification to be bypassed and encrypted traffic to be redirected to an unintended host, enabling interception or manipulation of data transmitted over the connection (man-in-the-middle attack). This results in violation of data confidentiality and integrity as well as the possibility of session hijacking.

Security patches available from the vendor should be applied in accordance with the references — update details are available in the official Node.js security bulletin from June 2026: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Node.js 22, Node.js 24, and Node.js 26 — all supported Node.js release lines.