CVE-2026-48618: Node.js TLS Wildcard Validation Bypass via Unicode Normalization

Technical summary

The vulnerability stems from inconsistent normalization of hostname strings during TLS certificate validation in Node.js. Specifically, the resolver and verifier components handle Unicode dot separators (such as U+3002, the ideographic full stop) differently when validating wildcard certificates. An attacker can present a certificate with a hostname containing these alternate Unicode characters that satisfy the initial resolver normalization but diverge during downstream verifier normalization, bypassing depth-based wildcard matching policies. This affects the TLS/SSL handshake mechanism across Node.js 22, 24, and 26 supported release lines. The root cause relates to CWE-176 (Improper Handling of Unicode Encoding) and CWE-289 (Authentication Bypass by Spoofing), indicating hostname normalization and authentication enforcement weaknesses.

Business impact

A successful exploitation could allow an authenticated attacker to decrypt previously encrypted communications or assume the identity of a trusted service within your application's TLS-protected connections. Organizations relying on Node.js applications for API gateways, microservices, or internal service meshes face elevated risk if those connections assume strict wildcard hostname validation. The medium CVSS score reflects the requirement for prior authentication, but the confidentiality impact (high) means sensitive data exposure is possible if an attacker obtains legitimate credentials. Organizations must assume any Node.js-based TLS endpoint is at risk until patched.

Affected systems

All supported release lines are vulnerable: Node.js 22.x, Node.js 24.x, and Node.js 26.x. Any application or service running on these versions that initiates or validates TLS connections—including HTTPS servers, client libraries, and microservice communication—is potentially affected. Legacy or unsupported versions (18.x, 20.x, and earlier) are outside the stated scope, but you should verify your exact Node.js inventory to ensure no surprise deployments exist in production or development environments.

Exploitability

Exploitation requires the attacker to possess valid credentials (authentication is mandatory per the CVSS vector PR:L). The attack does not require user interaction and is network-accessible. The attacker must be in a position to present a malicious certificate during the TLS handshake—typically via man-in-the-middle positioning or through a compromised certificate authority. Given the moderate AC:L (low attack complexity), once credentials are obtained, the technique is straightforward to execute. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting limited public weaponization to date, but security teams should not interpret this as low real-world risk.

Remediation

Apply the latest security patches released by the Node.js project for versions 22, 24, and 26. The Node.js security advisory will specify the exact patched version numbers for each release line—verify the specific version available for your supported release branch. If you cannot immediately patch, review your TLS endpoint configurations to identify and isolate services that accept certificates with Unicode characters in hostnames and consider restricting such certificates at your infrastructure layer pending patch deployment. Audit recent connection logs for any unusual certificate validation anomalies.

Patch guidance

Check the official Node.js security advisories and release notes for patched versions in the 22.x, 24.x, and 26.x series. Patches should be tested in a staging environment before production rollout to ensure no regression in certificate validation or application behavior. The fix will likely normalize Unicode dot separators consistently across both resolver and verifier code paths. After patching, restart all Node.js applications to activate the corrected TLS validation logic. Monitor application logs and TLS handshake metrics during and after deployment for any unexpected failures.

Detection guidance

Monitor TLS handshakes and certificate validation events in your Node.js application logs and network traffic. Look for successful certificate validations followed by connection anomalies, or for certificates presenting hostnames with Unicode dot separators (U+3002, U+FF0E, U+FF61, etc.) in the Common Name or Subject Alternative Name fields. Inspect packet captures for non-ASCII characters in TLS ClientHello and ServerHello messages. If you maintain a certificate transparency log or perform TLS certificate pinning, cross-check for unexpected issuances to your domain names with these Unicode variants. Network IDS/IPS signatures targeting Unicode normalization attacks may also flag malicious handshakes.

Why prioritize this

This vulnerability merits immediate attention despite its medium CVSS score. The authentication requirement limits blast radius, but the high confidentiality impact means any compromised credential holder can potentially decrypt sensitive traffic. Node.js is ubiquitous in modern application architectures, and wildcard certificate validation is a critical security boundary. The fact that all three supported release lines (22, 24, 26) are affected suggests broad ecosystem exposure. Prioritize patching production Node.js instances handling sensitive data or inter-service communication, followed by development and testing environments.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), but mitigated by the requirement for low-privileged authentication (PR:L). No user interaction is needed (UI:N), and the scope is unchanged (S:U). The confidentiality impact is rated high (C:H), indicating potential disclosure of sensitive information, while integrity and availability are unaffected. Organizations with strong credential hygiene and network segmentation may experience lower practical risk, but the high confidentiality rating warrants treating this as elevated priority within your patch cycle.

Frequently asked questions