Node.js Multiple Vulnerabilities
CSIRTS triage
- What
- Multiple vulnerabilities have been identified in Node.js.
- Who is affected
- All deployments of Node.js are potentially affected.
- Urgency
- Remediation is necessary as vulnerabilities could be exploited in future attacks.
- Action
- Update to the latest version of Node.js.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Node.js
Get an email when a new Node.js advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20260622
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-486150.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all scored CVEs.
- Low exploitation riskCVE-2026-486170.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.
- Low exploitation riskCVE-2026-486180.67% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all scored CVEs.
- Low exploitation riskCVE-2026-486190.66% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all scored CVEs.
- Low exploitation riskCVE-2026-489280.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
- Low exploitation riskCVE-2026-489300.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
- Low exploitation riskCVE-2026-489310.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.
- Moderate exploitation riskCVE-2026-489332.8% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 85% of all scored CVEs.
- Low exploitation riskCVE-2026-489340.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
- Low exploitation riskCVE-2026-489350.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-48615 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48617 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48618 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48619 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48928 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48930 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48931 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48933 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48934 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48935 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48936 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48937 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [high] Node.js: Multiple vulnerabilitiescert-bund
- lowCVE-2026-48936: A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain soc…nvd
- lowCVE-2026-48935: A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that …nvd
- mediumCVE-2026-48934: A flaw in Node.js TLS host verification can cause an attacker to bypass certification validati…nvd
- highCVE-2026-48933: A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encry…nvd
- criticalCVE-2026-48930: A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent au…nvd
- mediumCVE-2026-48928: A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context …nvd
- highCVE-2026-48619: A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, …nvd
- mediumCVE-2026-48618: A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can l…nvd
- highCVE-2026-48615: A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUN…nvd
More from HKCERT Security Bulletins
- unknownJuniper Junos OS Multiple Vulnerabilities2026-07-09
- unknownGoogle Chrome Multiple Vulnerabilities2026-07-09
- unknownPalo Alto Products Multiple Vulnerabilities2026-07-09
- unknownBeyondTrust Products Multiple Vulnerabilities2026-07-08
- unknownApple Products Multiple Vulnerabilities2026-07-06