PT-2026-52060 · Openjs Foundation · Node.Js

Published 2026-06-23 · Updated 2026-06-26 · CVE-2026-48928

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.0.0 through 26.3.0

Description An inconsistency in hostname matching can lead to a trust-policy bypass within multi-context mTLS (mutual Transport Layer Security) setups. mTLS is a process where both the client and server authenticate each other using digital certificates.

Recommendations Update Node.js 22 to the latest patched version. Update Node.js 24 to the latest patched version. Update Node.js 26 to version 26.3.1-1.1 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-48928

OPENSUSE-SU-2026:11110-1

OPENSUSE-SU-2026:11121-1

SUSE-SU-2026:2633-1

Affected Products

Node.Js

References · 76

• https://osv.dev/vulnerability/openSUSE-SU-2026:11121-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2633-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48928 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:11110-1 · Vendor Advisory
• https://bugzilla.suse.com/1268608 · Note
• https://bugzilla.suse.com/1268605 · Note
• https://suse.com/security/cve/CVE-2025-55130 · Note
• https://bugzilla.suse.com/1268554 · Note
• https://suse.com/security/cve/CVE-2026-48615 · Note
• https://bugzilla.suse.com/1268592 · Note
• https://suse.com/security/cve/CVE-2026-21715 · Note
• https://suse.com/security/cve/CVE-2026-21717 · Note
• https://suse.com/security/cve/CVE-2026-48937 · Note
• https://bugzilla.suse.com/1262274 · Note
• https://suse.com/security/cve/CVE-2026-21714 · Note