CVE-2026-48933: Node.js WebCrypto DOS Vulnerability

CVE-2026-48933 Overview

CVE-2026-48933 is a denial of service vulnerability in the Node.js WebCrypto implementation. The flaw crashes the Node.js process when the input to subtle.encrypt() is a multiple of 2 GiB. An attacker who can influence the size of data passed to the WebCrypto API can trigger a process termination, disrupting availability of the service.

The vulnerability affects all supported Node.js release lines: Node.js 22, Node.js 24, and Node.js 26. The issue is tracked under [CWE-190] (integer overflow) and [CWE-770] (allocation of resources without limits).

Critical Impact
Remote attackers can crash Node.js processes by submitting inputs sized as multiples of 2 GiB to subtle.encrypt(), resulting in denial of service against applications relying on WebCrypto.

Affected Products

Node.js 22.22.3 and prior 22.x releases
Node.js 24.16.0 and prior 24.x releases
Node.js 26.3.0 and prior 26.x releases

Discovery Timeline

2026-06-26 - CVE-2026-48933 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-48933

Vulnerability Analysis

The vulnerability resides in the Node.js WebCrypto implementation, specifically in the subtle.encrypt() method exposed by the crypto.subtle interface. When an application passes plaintext whose length is an exact multiple of 2 GiB, the encryption path fails to handle the size correctly and aborts the Node.js process.

Because subtle.encrypt() is often exposed indirectly to attacker-controlled data — for example when servers encrypt user-supplied payloads, session data, or file uploads — a remote attacker can craft input sizes that force the crash. The result is a full process termination rather than a caught exception, breaking availability for all clients served by that Node.js instance.

Root Cause

The root cause combines an integer overflow condition [CWE-190] with unbounded resource handling [CWE-770] in the WebCrypto layer. Length calculations for buffers at exactly 2 GiB boundaries wrap or exceed internal limits, and no upstream validation rejects the oversized input before it reaches the native cryptographic backend. The failure propagates as an uncaught fatal error.

Attack Vector

Exploitation requires only network access to an endpoint that forwards attacker-controlled data into subtle.encrypt(). No authentication and no user interaction are required. The attacker submits a payload sized at a multiple of 2 GiB (2 GiB, 4 GiB, 6 GiB, etc.). Applications that stream or accumulate large uploads before invoking WebCrypto are the most direct targets. The EPSS score is 2.445% at the 82nd percentile, reflecting elevated exploitation likelihood relative to average CVEs.

No public proof-of-concept exploit is currently available. See the Node.js Security Blog Post for technical details.

Detection Methods for CVE-2026-48933

Indicators of Compromise

Unexpected Node.js process termination or restart events correlated with large inbound HTTP request bodies.
Fatal error log entries from the Node.js runtime referencing the crypto or webcrypto subsystem near a crash.
Repeated inbound requests with Content-Length values at or near multiples of 2,147,483,648 bytes (2 GiB).
Sudden spikes in service unavailability without corresponding CPU or memory saturation trends.

Detection Strategies

Inventory all running Node.js versions and flag hosts on 22.x, 24.x, or 26.x below the fixed releases identified in the Node.js Security Blog Post.
Instrument reverse proxies and load balancers to log request sizes and correlate 2 GiB-aligned payloads with backend restarts.
Enable process supervision (systemd, PM2, Kubernetes) to capture exit codes and stack traces from crashing Node.js workers.
Audit application code for direct or indirect use of crypto.subtle.encrypt() on untrusted input.

Monitoring Recommendations

Alert on repeated Node.js worker crashes within short time windows on the same host or pod.
Monitor HTTP ingress for anomalously large request bodies, especially those exceeding 2 GiB.
Track WebCrypto call volume and input sizes via application performance monitoring where available.

How to Mitigate CVE-2026-48933

Immediate Actions Required

Upgrade Node.js to the patched release for your major line as listed in the Node.js Security Blog Post.
Apply the vendor updates referenced in Red Hat CVE Analysis CVE-2026-48933 for RHEL-based deployments.
Enforce request body size limits at the reverse proxy and application layer to reject payloads approaching 2 GiB.
Restart Node.js services after patching to ensure the vulnerable binary is no longer resident in memory.

Patch Information

The Node.js project released fixed versions in the June 2026 security releases. Consult the Node.js Security Blog Post for the exact patched version numbers for the 22.x, 24.x, and 26.x lines. Red Hat has issued advisories including RHSA-2026:28727, RHSA-2026:29012, RHSA-2026:30172, RHSA-2026:7378, and RHSA-2026:9455.

Workarounds

Reject or truncate any input to subtle.encrypt() larger than a safe application-defined threshold well below 2 GiB.
Wrap WebCrypto calls in worker processes or child processes so a crash does not terminate the primary service.
Configure client_max_body_size in NGINX or equivalent limits in your reverse proxy to block oversized uploads before they reach Node.js.

bash

# NGINX example: cap request bodies well below the 2 GiB trigger
http {
    client_max_body_size 100M;
}