A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS Details
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade v8-12.4-develUpgrade nodejs-docsUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs-packaging | Jul 7, 2026 | Jul 6, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jun 29, 2026 | Jun 26, 2026 |
| Debian | — | Upgrade nodejs | Sep 30, 2026 | Jun 26, 2026 |
| Redhat_linux | — | Upgrade nodejs24-develUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs24Upgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs-debuginfoUpgrade nodejs24-libsUpgrade nodejs24-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs24-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs22-debugsourceUpgrade npmUpgrade nodejs-npmNo solution existsUpgrade nodejs22-debuginfoUpgrade v8-12.4-develUpgrade nodejs-packagingUpgrade nodejs24-npmUpgrade nodejs24-docsUpgrade nodejs24-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-nodemon | Jul 7, 2026 | Jun 26, 2026 |
| Rocky_linux | — | Upgrade nodejs24-debuginfoUpgrade nodejs24-debugsourceUpgrade v8-12.4-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs24-libsUpgrade nodejs24-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade nodejs24Upgrade nodejs-npmUpgrade nodejs-develUpgrade npmUpgrade v8-13.6-develUpgrade nodejs22-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs22-debuginfo | Jul 10, 2026 | Jul 7, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2026 | Jun 26, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub