A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS Details
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejsUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packaging | Jul 7, 2026 | Jul 6, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jun 29, 2026 | Jun 26, 2026 |
| Debian | — | Upgrade nodejs | Sep 30, 2026 | Jun 26, 2026 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs24-docsNo solution existsUpgrade npmUpgrade nodejs-libsUpgrade v8-12.4-develUpgrade nodejs22-debuginfoUpgrade nodejs-npmUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs24-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs-develUpgrade nodejs24-develUpgrade nodejs-docsUpgrade nodejs24-debugsourceUpgrade nodejs-debugsourceUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-full-i18nUpgrade nodejs-debuginfoUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs24Upgrade nodejs-packaging-bundler | Jul 7, 2026 | Jun 26, 2026 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs24-full-i18nUpgrade v8-12.4-develUpgrade nodejs24-libsUpgrade nodejs-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs24Upgrade nodejs-develUpgrade nodejs-libsUpgrade npmUpgrade v8-13.6-develUpgrade nodejs-npmUpgrade nodejs-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs22-debugsourceUpgrade nodejs | Jul 10, 2026 | Jul 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub