CVE-2026-48618 is a vulnerability in Node.js where improper handling of Unicode encoding in TLS hostname verification causes a mismatch between resolver and verifier hostname normalization. This leads to a TLS wildcard-depth authentication bypass, undermining the security boundary and potentially exposing confidential information. The vulnerability affects Node.js versions 22, 24, and 26, specifically including versions 22.22.3, 24.16.0, and 26.3.0. The issue is classified under CWE-176 (Improper Handling of Unicode Encoding) and CWE-289 (Authentication Bypass). Red Hat has published multiple advisories and errata providing security updates that fix this vulnerability in their Node.js builds. The CVSS score of 7.7 reflects a high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and a confidentiality impact with no integrity or availability impact.

The vulnerability allows an attacker to bypass TLS hostname verification due to Unicode dot separator normalization mismatches, potentially leading to unauthorized access beyond intended security boundaries. This can result in confidentiality breaches of sensitive data transmitted over TLS connections. There is no reported impact on integrity or availability. The flaw affects all supported Node.js release lines (22, 24, 26) and specific versions identified by Red Hat advisories.

Red Hat has released security updates addressing this vulnerability in their Node.js packages. Users should apply the relevant updates from Red Hat advisories (e.g., RHSA-2026:39246) to remediate the issue. Since this is not a cloud service, remediation requires updating the affected Node.js versions. Patch status is confirmed via Red Hat advisories. No vendor advisory indicates that no action is required; therefore, applying the official patches is recommended.