Node.js Patches 12 CVEs in June Security Release, Two Rated High, as End-of-Life Node 20 Is Left Without a Fix

Overview

The Node.js project shipped a coordinated security release across all three of its supported release lines on June 18, 2026, patching a batch of vulnerabilities that included two high-severity flaws. According to the Node.js project, the fixes landed in v22.23.0, v24.17.0 and v26.3.1. The update addressed 12 CVEs in total, two of which were rated high severity, as reported by GBHackers.

The release also leaves a sizable installed base exposed: Node.js 20, which reached end of life on April 30, 2026, receives no patch for any of these issues.

What We Know

The security release affects the Node.js 22.x, 24.x and 26.x lines, with patched builds published as v22.23.0, v24.17.0 and v26.3.1, according to the Node.js project. Alongside the application-level fixes, the release bumped bundled dependencies on all lines, including OpenSSL to 3.5.7.

A breakdown published by Digital Applied categorizes the 12 CVEs as 2 high, 6 medium and 4 low severity.

The two high-severity entries both concern attacker-influenced behavior in core subsystems. The first, CVE-2026-48933, is a flaw in the WebCrypto implementation that, per the Node.js project, “can crash the process if the input of subtle.encrypt() is a multiple of 2GiB” — a denial-of-service condition triggered by an integer overflow on oversized input. The second, CVE-2026-48618, is described by the Node.js project as a case where “unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch.” According to GBHackers, the mismatch between hostname resolution and certificate validation can enable attackers to bypass TLS wildcard authentication.

Several of the medium- and low-severity issues cluster around networking and the runtime’s permission model. CVE-2026-48619 is a flaw in the HTTP/2 client that, according to the Node.js project, “allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.” CVE-2026-48615 covers proxy tunnel error handling that “could expose proxy credentials in ERR_PROXY_TUNNEL error messages,” per the same advisory. Two further low-severity issues, CVE-2026-48617 and CVE-2026-48936, involve bypasses of the experimental Permission Model — the latter affecting only the 26.x line.

What We Don’t Know

The advisory does not indicate that any of the 12 vulnerabilities have been exploited in the wild, and no exploitation status is reported by the cited sources. The real-world impact will depend on how quickly operators upgrade, which the project does not track publicly.

Analysis

The more consequential story for many operators is what the release does not cover. Node.js 20 reached end of life on April 30, 2026, and according to Digital Applied, “gets no official patch for any of these CVEs,” leaving organizations still running it with what the same source calls “zero official mitigation path for these CVEs from the Node.js project itself.” That end-of-life date is corroborated by endoflife.date, which lists Node 20’s security support as having ended on April 30, 2026.

The Node.js advisory makes the underlying principle explicit, noting that “End-of-Life versions are always affected when a security release occurs” and directing users to run a supported version, per the Node.js project. The currently supported lines — Node 22 in maintenance LTS through April 30, 2027, Node 24 in active LTS through April 30, 2028, and the newly released Node 26 through April 30, 2029 — are listed by endoflife.date as the safe upgrade targets for teams still on the now-unsupported 20.x line.