Security Advisory - Published 2026-06-27 - Node.js Runtime
Node.js June 2026 release: check TLS hostname, proxy errors, HTTP/2 clients, and WebCrypto pressure
This Node.js group is about runtime behavior: TLS hostname validation, proxy tunnel errors, HTTP/2 client memory pressure, and WebCrypto input handling. Patch the runtime used by production services and rebuild containers or serverless images that bundle Node.
Affected CVEs in this batch
| CVE | Product | Affected | Review | CVSS |
|---|---|---|---|---|
| CVE-2026-48930 | Node.js | vendor-fixed release | runtime logs | 9.8 |
| CVE-2026-48618 | Node.js | vendor-fixed release | runtime logs | 7.7 |
| CVE-2026-48615 | Node.js | vendor-fixed release | runtime logs | 7.5 |
| CVE-2026-48619 | Node.js | vendor-fixed release | runtime logs | 7.5 |
| CVE-2026-48933 | Node.js | vendor-fixed release | runtime logs | 7.5 |
What to check
- Production Node.js versions in containers, serverless runtimes, build images, and desktop/server packages.
- TLS clients that connect to user-supplied or tenant-controlled hostnames.
- Proxy tunnel failures that may have exposed credentials in logs or error trackers.
- HTTP/2 clients that accept arbitrary upstream servers or many ORIGIN frames.
- WebCrypto paths that process large buffers or untrusted data sizes.
Safe fix path
- Upgrade Node.js to a release that includes the June 2026 security fixes.
- Rebuild containers and deployment artifacts so the patched runtime is actually active.
- Rotate proxy credentials if tunnel errors may have been logged with secrets.
- Keep error tracker and access-log evidence before clearing noisy incidents.
Compromise indicators
- New users, role changes, unexpected sessions, or unknown API tokens.
- Files changed during the exposure window, especially executable files or generated configs.
- Repeated application errors, database errors, queue failures, or unusual outbound requests.
- Plugin, container, service, or package versions that differ from the expected deployment record.
When to ask Ping7 for repair
Use Ping7 CVE Repair when the affected component is public, logs show suspicious activity, patching may break production, or cleanup requires file, database, user, token, or container review.