CVE-2026-48933: Node.js WebCrypto Denial-of-Service Vulnerability (v22, v24, v26)

Technical summary

CVE-2026-48933 is a denial-of-service vulnerability in the Node.js WebCrypto implementation. The flaw exists in the `subtle.encrypt()` function, where improper handling of buffer sizes leads to a process crash when the input size is a multiple of 2GiB. The vulnerability stems from integer overflow and resource exhaustion issues (CWE-190, CWE-770). An unauthenticated remote attacker can exploit this over the network by sending a specially crafted request containing encryption input of the triggering size, causing the Node.js process to terminate and interrupting service availability.

Business impact

Organizations running Node.js applications that expose WebCrypto encryption endpoints face availability risk. A remote attacker can repeatedly trigger process crashes, effectively taking down services without breaching confidentiality or integrity. This is particularly damaging for microservices architectures or serverless platforms where individual Node.js instances handle high request volumes; repeated crashes degrade user experience and may trigger auto-scaling or resource exhaustion. Incident response overhead and potential SLA violations are compounding concerns.

Affected systems

All currently supported Node.js release lines are vulnerable: Node.js 22, Node.js 24, and Node.js 26. Any application running these versions that uses the WebCrypto API for encryption operations (via `subtle.encrypt()`) is at risk. This includes both explicit cryptographic endpoints and any internal usage of the WebCrypto module for encryption tasks.

Exploitability

This vulnerability has a high exploitability profile. It requires no authentication, no user interaction, and no special configuration—an attacker on the network can trigger the crash by sending a single request with a 2GiB-multiple-sized encryption input. The CVSS 3.1 score of 7.5 (HIGH) reflects the ease of exploitation and the guaranteed denial-of-service outcome. However, practical exploitation is somewhat limited by the need to transmit or reference 2GiB payloads; bandwidth constraints may slow attacks, but patient or well-positioned attackers can succeed. The vulnerability has not been added to the CISA KEV catalog, indicating it is not yet observed in active exploitation campaigns.

Remediation

Apply patches from the Node.js project for versions 22, 24, and 26 immediately. Consult the official Node.js security advisory for specific patched version numbers and verify compatibility with your application stack. As a temporary mitigation, implement rate limiting and request size caps on endpoints that accept WebCrypto encryption input, and monitor process restart rates for unexplained crashes. Consider running Node.js behind a reverse proxy that enforces maximum payload sizes.

Patch guidance

Visit the official Node.js security advisories and release notes to identify the patched versions for your release line (22, 24, or 26). Apply patches in a staged manner: test in pre-production environments first, verify application compatibility, and then roll out to production. Monitor process stability post-patch and correlate with your deployment logs. Verify against the vendor advisory that your patched version addresses CVE-2026-48933 specifically.

Detection guidance

Monitor Node.js process exit logs and restart frequencies for unexplained crashes, particularly those coinciding with unusually large requests to WebCrypto endpoints. Use application performance monitoring (APM) tools to track `subtle.encrypt()` call latency and failure rates. Network-level detection is challenging because the attack appears as a legitimate encryption request; focus instead on behavioral anomalies such as repeated process terminations. Implement structured logging that captures request payload sizes and correlate with process crash timestamps. Security Information and Event Management (SIEM) systems should flag patterns of rapid Node.js restarts.

Why prioritize this

This vulnerability merits immediate attention because it affects all three currently supported Node.js release lines, has high exploitability (CVSS 7.5), and can be triggered remotely without authentication. While not yet exploited in the wild, the simplicity of the attack vector and the guaranteed denial-of-service outcome make it an attractive target for disruptive campaigns. Delay in patching leaves production services exposed to service interruption.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is assigned under the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), no integrity impact (I:N), but high availability impact (A:H). The score appropriately captures a pure denial-of-service condition that is trivial to execute but does not compromise data or system control.

Frequently asked questions