CVE-2026-48618 is a high-severity vulnerability in Node.js TLS hostname handling caused by improper handling of Unicode encoding (CWE-176). The flaw arises from mismatches in resolver and verifier hostname normalization related to Unicode dot separators, enabling a wildcard-depth authentication bypass. This can lead to confidentiality breaches by allowing unauthorized access under affected configurations. The vulnerability affects exact versions =22.22.3, =24.16.0, and =26.3.0 of Node.js. No known exploits are reported in the wild, and no official remediation or patch is currently documented.

The vulnerability allows bypassing TLS wildcard hostname authentication, which can compromise confidentiality by permitting unauthorized entities to impersonate or access protected resources. There is no reported impact on integrity or availability. The flaw affects specific Node.js versions and can undermine the security boundary intended by TLS hostname verification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Node.js security advisories for updates. Until a patch is available, consider mitigating risk by restricting usage of affected Node.js versions in sensitive environments or applying additional application-layer hostname verification controls.