What is GHSA-g57m-hr98-5m89?

GHSA-g57m-hr98-5m89 is a security advisory published by GitHub Security Advisories with High severity. A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...

Which CVE IDs does GHSA-g57m-hr98-5m89 cover?

GHSA-g57m-hr98-5m89 covers the following CVE IDs: CVE-2026-48618. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g57m-hr98-5m89?

GHSA-g57m-hr98-5m89 has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

GHSA-g57m-hr98-5m89HighCVSS 7.7

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...

Vendor

GitHub Security Advisories

Published

June 26, 2026

Last Modified

June 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-48618 →

📋 Description

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-48618
https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
https://github.com/advisories/GHSA-g57m-hr98-5m89