CVE-2026-48930 Overview
CVE-2026-48930 is a flaw in Node.js Transport Layer Security (TLS) hostname handling. Embedded-nul hostnames trigger silent authority rebinding due to c-string truncation in resolver bindings. Attackers can exploit the truncation mismatch to route TLS connections to unintended hosts while bypassing hostname verification.
The vulnerability affects all supported Node.js release lines, including Node.js 22, Node.js 24, and Node.js 26. It maps to CWE-284: Improper Access Control and is network-exploitable without authentication or user interaction.
Critical Impact
Authority rebinding in TLS hostname resolution can allow attackers to bypass hostname validation and redirect traffic to attacker-controlled endpoints, breaking the confidentiality and integrity guarantees of TLS connections.
Affected Products
- Node.js 22 (including 22.22.3)
- Node.js 24 (including 24.16.0)
- Node.js 26 (including 26.3.0)
Discovery Timeline
- 2026-06-26 - CVE-2026-48930 published to the National Vulnerability Database (NVD)
- 2026-06-26 - Last updated in NVD database
Technical Details for CVE-2026-48930
Vulnerability Analysis
The flaw resides in how Node.js passes hostnames from JavaScript strings into native resolver bindings. JavaScript strings can contain embedded nul (\0) bytes, but the underlying C resolver code treats hostnames as nul-terminated c-strings. When a hostname such as trusted.example.com\0attacker.example.net is supplied, the JavaScript layer validates or displays the full string, while the native layer truncates it at the first nul byte.
This parser differential means TLS authority checks and DNS resolution can operate on different hostnames. The result is silent authority rebinding: certificate validation logic sees one host, but the connection resolves and authenticates against another.
Root Cause
The root cause is inconsistent string handling between JavaScript and native resolver bindings. C-string truncation at the first nul byte violates the assumption that hostname strings retain their full JavaScript representation through the TLS pipeline. This is a classic access control weakness [CWE-284] triggered by data representation mismatch across a language boundary.
Attack Vector
An attacker crafts a URL, connection string, or Server Name Indication (SNI) value containing an embedded nul byte. When a Node.js application passes this hostname to tls.connect(), https.request(), or similar APIs, the resolver truncates the string while higher-level validation logic uses the untruncated form. The connection then completes against an attacker-chosen host without triggering hostname verification failures.
For exploitation code and reproduction details, refer to the Node.js Security Release Blog. No public proof-of-concept or exploit-in-the-wild reports are currently associated with this CVE.
Detection Methods for CVE-2026-48930
Indicators of Compromise
- Outbound TLS connections from Node.js processes to hostnames not present in application configuration or allow-lists.
- Hostnames or URLs in application logs containing embedded nul bytes (\0, %00, or \\x00) in the host component.
- DNS resolutions from Node.js hosts that do not match the hostname recorded in application-layer request logs.
Detection Strategies
- Inspect application and reverse proxy logs for URL or Host header values containing %00 or raw nul bytes in the authority component.
- Correlate DNS query logs with application request logs to identify divergence between requested hostnames and resolved hostnames.
- Audit user-controlled input paths that flow into http, https, tls, or dns module calls for missing nul-byte validation.
Monitoring Recommendations
- Enable verbose TLS and DNS logging on Node.js services handling untrusted hostname input.
- Alert on Node.js process versions matching 22.22.3, 24.16.0, 26.3.0, or earlier vulnerable builds.
- Track outbound network telemetry from Node.js workloads for connections to unexpected destinations following user-supplied URL input.
How to Mitigate CVE-2026-48930
Immediate Actions Required
- Inventory all Node.js deployments across the 22, 24, and 26 release lines and prioritize patching internet-facing and multi-tenant services.
- Apply the fixed Node.js releases documented in the June 2026 security advisory as soon as they are validated in your environment.
- Add server-side validation to reject hostnames containing nul bytes or non-LDH (letters, digits, hyphen) characters before invoking network APIs.
Patch Information
Node.js has released fixed versions as part of the June 2026 security releases covering the 22, 24, and 26 branches. Refer to the Node.js Security Release Blog for exact patched version numbers, upgrade instructions, and backport availability.
Workarounds
- Sanitize hostnames at the application layer by rejecting any input where hostname.indexOf('\0') !== -1 before passing values to network APIs.
- Enforce strict allow-lists of permitted destination hostnames for outbound TLS connections from Node.js services.
- Front Node.js services with a reverse proxy or Web Application Firewall (WAF) rule that strips or blocks requests containing %00 in the host or URL fields.
# Configuration example: validate hostnames before use in Node.js
# Reject embedded nul bytes prior to tls.connect() / https.request()
node -e "const h=process.argv[1]; if(h.includes('\\0')){process.exit(2)}" "$USER_HOSTNAME"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
