CVE-2026-48928 Overview
CVE-2026-48928 is an access control weakness [CWE-284] in Node.js hostname matching logic. The inconsistency allows a trust-policy bypass in multi-context mutual TLS (mTLS) deployments. An authenticated client can present a certificate that is evaluated inconsistently across TLS contexts, causing Node.js to trust a peer that a stricter policy should reject.
The issue affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. Exploitation requires network access and low-privilege authentication but no user interaction.
Critical Impact
An attacker with a valid certificate in one mTLS context can bypass hostname-based trust policies and access resources scoped to a different context, breaking tenant isolation in multi-context TLS deployments.
Affected Products
- Node.js 22 (through 22.22.3)
- Node.js 24 (through 24.16.0)
- Node.js 26 (through 26.3.0)
Discovery Timeline
- 2026-06-26 - CVE-2026-48928 published to the National Vulnerability Database (NVD)
- 2026-06-26 - Last updated in the NVD database
Technical Details for CVE-2026-48928
Vulnerability Analysis
The vulnerability originates in how Node.js compares certificate identifiers to expected hostnames during TLS peer validation. When an application configures multiple tls.SecureContext objects, for example separate contexts per tenant or per Server Name Indication (SNI) endpoint, the hostname matcher does not enforce identical parsing rules across all validation paths.
An attacker who holds a certificate valid in one context can craft or select subject fields that satisfy the relaxed matcher but should be rejected by the stricter policy applied to another context. The result is a trust-policy bypass rather than a full authentication bypass, because a valid client certificate is still required.
The vulnerability enables limited confidentiality and integrity impact on data reachable through the wrongly trusted context. Availability is not affected.
Root Cause
The root cause is inconsistent hostname matching between certificate identity extraction and policy evaluation code paths. The Subject Alternative Name (SAN) and Common Name (CN) handling produces different results depending on which validation entry point is used. This mismatch is classified under [CWE-284] Improper Access Control.
Attack Vector
An attacker requires network reachability to a Node.js service using mTLS with more than one tls.SecureContext. The attacker must possess a client certificate that is legitimate for at least one context. By connecting with SNI values or certificate identifiers that exploit the parser inconsistency, the attacker induces Node.js to apply the wrong trust policy and accept the connection under a context to which the certificate should not grant access.
No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities (KEV) listing exists at the time of publication. The Exploit Prediction Scoring System (EPSS) probability is 0.256%.
The vulnerability manifests in the internal hostname-verification routine invoked by Node.js TLS peer identity checks. Refer to the Node.js June 2026 Security Releases advisory for implementation-level details.
Detection Methods for CVE-2026-48928
Indicators of Compromise
- Successful mTLS handshakes where the presented client certificate's SAN or CN does not match the hostname policy documented for the target tls.SecureContext.
- TLS session logs showing SNI values that resolve to a different security context than the certificate's issued scope.
- Application audit logs indicating cross-tenant resource access from a client certificate scoped to a single tenant.
Detection Strategies
- Enable verbose TLS logging in Node.js using NODE_DEBUG=tls and correlate SNI, certificate subject, and the context selected for each handshake.
- Compare req.socket.getPeerCertificate() output against the expected authorization scope inside request handlers and log divergences.
- Deploy network detection rules that flag mTLS sessions where SNI and certificate identity fields diverge from documented tenant mappings.
Monitoring Recommendations
- Centralize TLS handshake and application authorization logs and alert on peer certificates authenticated against unexpected contexts.
- Track Node.js runtime versions across the fleet and alert on any host still running 22.22.3, 24.16.0, or 26.3.0 or earlier.
- Monitor for anomalous client identifiers accessing tenant-scoped API endpoints outside their normal pattern.
How to Mitigate CVE-2026-48928
Immediate Actions Required
- Upgrade Node.js to the fixed releases published in the June 2026 security release for the 22.x, 24.x, and 26.x lines.
- Inventory all services that instantiate multiple tls.SecureContext objects or use SNICallback for tenant separation and prioritize them for patching.
- Rotate any client certificates that could have been used to reach unintended contexts if abuse is suspected.
Patch Information
The Node.js project addressed CVE-2026-48928 in the June 2026 security releases across the 22, 24, and 26 lines. Patch details and downloadable binaries are available in the Node.js Security Blog Post.
Workarounds
- Enforce authorization checks inside application handlers by comparing getPeerCertificate() fields against an allowlist tied to the expected tenant, rather than relying solely on TLS-layer policy.
- Consolidate to a single tls.SecureContext where feasible, or split multi-tenant workloads onto separate processes and ports so each listener has one trust policy.
- Restrict access to affected services with network-layer controls until the patched Node.js runtime is deployed.
# Verify the installed Node.js version and upgrade if vulnerable
node --version
# Example upgrade using nvm to a fixed release line
nvm install --lts
nvm alias default 'lts/*'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
