null-byte-interaction-error-(poison-null-byte)
CVE-2026-48930
Node.js
CVSS Details
CVSS Score
Medium
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-626 Null Byte Interaction Error (Poison Null Byte)
Description
A flaw in Node.js TLS hostname handling allows embedded-nul hostnames to cause silent authority rebinding. Because the resolver bindings treat hostnames as C strings, a hostname containing an embedded NUL byte is truncated at the NUL, causing the connection to be resolved and authority-checked against a different host than the full string represents. This discrepancy between the intended hostname and the truncated value can silently rebind the connection authority, bypassing the intended security boundary. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Disclosure Date
Public Disclosure
June 18, 2026