A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Base Score: 7.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade v8-12.4-develUpgrade nodejs-docsUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libs | Jul 7, 2026 | Jul 6, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jun 29, 2026 | Jun 26, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-docsUpgrade nodejs24-debugsourceUpgrade nodejs22-develUpgrade nodejs24-npmUpgrade nodejs22-debuginfoUpgrade nodejs24-develUpgrade nodejs22-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs22Upgrade nodejs24-libsUpgrade nodejs22-debugsourceUpgrade v8-13.6-develUpgrade v8-12.4-develUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-docsUpgrade nodejs24-debuginfoUpgrade nodejs24Upgrade nodejs24-full-i18nUpgrade nodejs22-npmUpgrade nodejs22-libs | Jul 8, 2026 | Jun 26, 2026 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs24-docsUpgrade nodejs-docsUpgrade nodejs24-debuginfoUpgrade nodejs-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs24Upgrade nodejs-packaging-bundlerUpgrade nodejs-npmUpgrade nodejs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs24-libsUpgrade nodejs22-debugsourceUpgrade nodejs24-develUpgrade nodejs-libsUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejsUpgrade nodejs24-npmUpgrade npmUpgrade nodejs24-libs-debuginfo | Jul 7, 2026 | Jun 26, 2026 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade v8-12.4-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs22-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24Upgrade nodejs24-full-i18nUpgrade nodejs24-libsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs22-debuginfoUpgrade nodejs24-develUpgrade v8-13.6-devel | Jul 10, 2026 | Jul 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub