CVE-2026-48618 is a vulnerability in Node.js involving a mismatch in the handling of TLS hostnames and unicode dot separators during authentication. This mismatch causes a wildcard-depth authentication bypass, allowing an attacker to circumvent intended security boundaries. The flaw affects Node.js versions 22, 24, and 26 as distributed by Red Hat. The vulnerability is classified under CWE-176 (Improper Handling of Unicode Encoding) and CWE-289 (Authentication Bypass). Red Hat has issued security advisories and updates addressing this issue, with patches available for affected versions.

The vulnerability allows an attacker to bypass TLS hostname authentication, potentially leading to unauthorized access and disclosure of sensitive information. This compromises the confidentiality of applications using Node.js TLS connections under affected configurations. The impact is rated as medium severity by Red Hat, with a CVSS base score around 7.7 indicating a significant confidentiality impact but no integrity or availability impact.

A patch is available for this vulnerability and should be applied to affected Node.js versions. Red Hat has released updated packages for Node.js 22, 24, and 26 that address this issue. Users are advised to upgrade to these fixed versions as soon as possible. No effective mitigations meeting Red Hat's criteria for ease of use and applicability are currently available, so patching is the primary remediation. Refer to the Red Hat advisory RHSA-2026:39246 for detailed update instructions.