Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-48928

Опубликовано: 26 июн. 2026
Источник: redhat
CVSS3: 4.2
EPSS Низкий

Описание

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS (mutual Transport Layer Security) setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive information or integrity compromise within the affected system.

Меры по смягчению последствий

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 8nodejsFix deferred
Red Hat Enterprise Linux 10nodejs24FixedRHSA-2026:3584106.07.2026
Red Hat Enterprise Linux 10nodejs22FixedRHSA-2026:3584206.07.2026
Red Hat Enterprise Linux 8nodejsFixedRHSA-2026:3986815.07.2026
Red Hat Enterprise Linux 8nodejsFixedRHSA-2026:4194720.07.2026
Red Hat Enterprise Linux 9nodejsFixedRHSA-2026:3589106.07.2026
Red Hat Enterprise Linux 9nodejsFixedRHSA-2026:3589206.07.2026
Red Hat Hardened Imagesnodejs26-main-26.4.0-1.3.hum1FixedRHSA-2026:3386630.06.2026
Red Hat Hardened Imagesnodejs24-main-24.18.0-0.2.hum1FixedRHSA-2026:3447801.07.2026
Red Hat Hardened Imagesnodejs22-main-22.23.1-2.hum1FixedRHSA-2026:3527203.07.2026

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-289
https://bugzilla.redhat.com/show_bug.cgi?id=2493333Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

EPSS

Процентиль: 12%
0.00216
Низкий

4.2 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.4
ubuntu
около 1 месяца назад

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS3: 5.4
nvd
около 1 месяца назад

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS3: 5.4
debian
около 1 месяца назад

A inconsistency in Node.js hostname matching can cause a trust-policy ...

CVSS3: 4.2
github
около 1 месяца назад

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

rocky
10 дней назад

Important: nodejs:22 security, bug fix, and enhancement update

EPSS

Процентиль: 12%
0.00216
Низкий

4.2 Medium

CVSS3