Node.js TLS Hostname Handling Vulnerability - 20260702002

Overview

The WASOC has been made aware of a vulnerability affecting Node.js hostname handling.

The vulnerability allows an attacker to exploit Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.

What is vulnerable?

Product(s) Affected	Version(s)	CVE	CVSS 3.0	Severity
Node.js	26.x prior to 26.3.1 24.x prior to 24.17.0 22.x prior to 22.23.0	CVE-2026-48930	9.8	Critical

What has been observed?

The WASOC has not received any reports of exploitation of this vulnerability on Western Australian Government networks at the time of writing.

Recommendation

The WASOC recommends administrators apply solutions as per vendor instructions to all affected devices within expected timeframes (refer Patch Management):

• NodeJS: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
• Github: https://github.com/advisories/GHSA-g779-8rvr-37xx