CVE-2026-48930

CVE-2026-48930 describes a vulnerability in Node.js TLS hostname handling where Embedded-nul hostnames can trigger silent authority rebinding due to c-string truncation in resolver bindings. Affected releases are Node.js 22, 24, and 26. The CVE is listed among fixes in the SUSE update for nodejs2...