Summary
Embedded NUL bytes can silently rebind TLS authority. This medium-severity finding affects Node.js.
Disclosure timeline
- Public disclosure
Credits
Cantina · Agent-discovered and human-verified
Vulnerability disclosure
Embedded NUL bytes can silently rebind TLS authority
CVE-2026-48930
- Affected product
- Node.js
- Severity
- Medium
- Weakness
- CWE-626
- Disclosed