A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 5.6
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade v8-13.6-develUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade v8-12.4-develUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade npm | Jul 7, 2026 | Jul 6, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jun 29, 2026 | Jun 26, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-debugsourceUpgrade nodejs24-npmUpgrade nodejs22-npmUpgrade nodejs22-libs-debuginfoUpgrade nodejs24-develUpgrade v8-13.6-develUpgrade nodejs22-develUpgrade nodejs24-docsUpgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-libsUpgrade nodejs24Upgrade nodejs24-debuginfoUpgrade nodejs22-docsUpgrade nodejs22-full-i18nUpgrade v8-12.4-develUpgrade nodejs24-full-i18nUpgrade nodejs22-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs22 | Jul 8, 2026 | Jun 26, 2026 |
| Redhat_linux | — | Upgrade nodejs24-debuginfoUpgrade nodejs-libsUpgrade nodejs24-docsUpgrade nodejs24-npmUpgrade nodejs-npmUpgrade v8-12.4-develUpgrade nodejs22-debuginfoUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs24-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs24-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs-develNo solution existsUpgrade nodejs-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-develUpgrade nodejs22-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs24Upgrade nodejs-docs | Jul 7, 2026 | Jun 26, 2026 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs24-full-i18nUpgrade nodejs22-debugsourceUpgrade v8-12.4-develUpgrade nodejs24-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs24Upgrade nodejs24-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24-debuginfoUpgrade npmUpgrade v8-13.6-develUpgrade nodejs24-develUpgrade nodejs22-debuginfoUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs-libs | Jul 10, 2026 | Jul 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub