Veille CVE

Vendredi 26 juin 2026

6 CVE

Critique 1 Élevée 2 Moyenne 1 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « nodejs node » ✕
  1. CVE-2026-48930 9.8 Critique

    nodejs node · Nodejs node.js

    A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

  2. CVE-2026-48928 5.4 Moyenne

    nodejs node · Nodejs node.js

    A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

  3. CVE-2026-48619 7.5 Élevée

    nodejs node · Nodejs node.js

    A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

  4. CVE-2026-48615 7.5 Élevée

    nodejs node · Nodejs node.js

    A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

  5. CVE-2026-48935 3.3 Faible

    nodejs node · Nodejs node.js

    A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

  6. CVE-2026-48936 3.3 Faible

    nodejs node · Nodejs node.js

    A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.