Threats tagged 'bit-node-2026-48618'

A vulnerability in Node.js TLS hostname handling involving Unicode dot separator normalization can cause a wildcard-depth authentication bypass. This flaw affects multiple supported Node.js release lines including versions 22, 24, and 26. The issue arises from mismatched hostname normalization between resolver and verifier components, potentially allowing an attacker to bypass intended TLS authentication boundaries. The vulnerability has a CVSS 3.0 score of 7.7, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Red Hat has released security updates addressing this issue in their Node.js packages.