CVE-2026-48933: Node.js WebCrypto AES integer overflow aborts the process
An integer overflow in the Node.js WebCrypto implementation aborts the process when the input to crypto.subtle.encrypt() is a multiple of 2 GiB. A remote attacker who can feed such input to an application's AES encryption path can crash the service. Fixed in the June 18, 2026 releases (High, CVSS 7.5; Red Hat Important); no known exploitation.
- CVE-2026-48933CVE identifier
- 7.5CVSS 3.1 base score (high)
- 3.7%EPSS: chance of exploitation in the next 30 days (higher than 90% of CVEs)
- 2026-06-26published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Node.js and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Node.js never reloads its binary or libraries: restart every long-running node process after updating. systemd: sudo systemctl restart <app>.service. PM2: pm2 update (restarts the PM2 daemon and all apps on the new runtime), then pm2 save; with nvm, reinstall pm2 under the new version first (nvm install --reinstall-packages-from does this). Containers: rebuild the image and recreate the containers / roll out the pods; restarting an old container keeps the old Node.js. Confirm with node -v in the same environment the service uses.
- If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Affected and fixed versions
Affected:
- Node.js 22.x up to 22.22.3
- Node.js 24.x up to 24.16.0
- Node.js 26.x up to 26.3.0
- End-of-life 20.x and 25.x received no fix
Fixed in:
- Node.js 22.23.0
- Node.js 24.17.0
- Node.js 26.3.1
Node.js lines affected: 22.x || 24.x || 26.x; fixed in ^22.23.0 || ^24.17.0 || ^26.3.1.
Am I affected?
node -v
dpkg -l nodejs 'libnode*' 2>/dev/null | grep ^ii # Debian/Ubuntu
rpm -q nodejs nodejs22 nodejs24 2>/dev/null; dnf module list --enabled nodejs # RHEL
apk info -v nodejs nodejs-current 2>/dev/null # Alpine
docker run --rm <image> node -v # containers
grep -rn "subtle.encrypt" --include='*.js' --include='*.mjs' --include='*.ts' . | headPatch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade nodejs
node -v
# Debian ships nodejs 18.x (bookworm) and 20.x (trixie) with backported fixes.
# Running 22/24/26 from NodeSource (deb.nodesource.com)? The same command installs the fixed upstream build.Ubuntu
# Ubuntu has not published a nodejs fix for this CVE (tracker status needs-triage, 2026-11-03).
# See https://ubuntu.com/security/CVE-2026-48933. Use a fixed upstream build instead:
# If Node.js comes from the NodeSource repo (deb.nodesource.com), the fixed builds are there:
sudo apt update
sudo apt install --only-upgrade nodejs
node -vRHEL, AlmaLinux, Rocky, Oracle
sudo dnf module list --enabled nodejs # RHEL 8/9: which stream is enabled
sudo dnf upgrade --refresh 'nodejs*'
node -v
# Stream with no fix (or EOL nodejs:20)? switch to a fixed stream, e.g. nodejs:24 on RHEL 8/9:
sudo dnf module reset -y nodejs && sudo dnf module enable -y nodejs:24 && sudo dnf distro-sync -y 'nodejs*'
# RHEL 10 ships nodejs22 / nodejs24 as normal packages: sudo dnf install nodejs24Fedora
sudo dnf upgrade --refresh nodejs22 nodejs24 (nodejsNN)SUSE / openSUSE
sudo zypper refresh
sudo zypper update nodejs22 nodejs24Amazon Linux
sudo dnf upgrade --releasever=latest nodejs22 nodejs24 (nodejsNN)Arch Linux
sudo pacman -SyuAlpine
apk update
apk upgrade nodejs # main repo (22.x on 3.22, 24.x on 3.23/3.24)
apk upgrade nodejs-current # community repo, if installed (26.x on 3.24)
node -vFreeBSD
pkg update && pkg upgrade node (or node22/node24)Docker images
# Move the FROM line to a fixed tag (or a moving major tag such as node:24-slim) and rebuild
# FROM node:24.22.2-trixie-slim (also: node:22.23.4-alpine, node:26.13.0-slim)
docker pull node:24.22.2-trixie-slim
docker build --pull -t myapp:patched .
docker run --rm myapp:patched node -v # must be at least 22.23.0 / 24.17.0 / 26.3.1
docker compose up -d --force-recreate # or redeploy / roll out the new imageBuilt from source
# nvm: install the newest patch release of your line and make it the default
nvm install 24 --reinstall-packages-from=current # or 22 / 26
nvm alias default 24
node -v # must be at least 22.23.0 / 24.17.0 / 26.3.1
# Official binaries (Linux x64); verify the checksum before installing
VER=v24.22.2 # current fixed releases: v22.23.4, v24.22.2, v26.13.0
curl -fsSLO https://nodejs.org/dist/$VER/node-$VER-linux-x64.tar.xz
curl -fsSLO https://nodejs.org/dist/$VER/SHASUMS256.txt
grep " node-$VER-linux-x64.tar.xz\$" SHASUMS256.txt | sha256sum -c -
sudo tar -xJf node-$VER-linux-x64.tar.xz -C /usr/local --strip-components=1
/usr/local/bin/node -vGeneral update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | nodejs | fixed | 18.20.4+dfsg-1~deb12u3 |
| Debian 13 | nodejs | fixed | 20.19.2+dfsg-1+deb13u3 |
| Debian testing | nodejs | fixed | 24.17.0+dfsg+~cs24.13.2-1 |
| Red Hat Enterprise Linux 9 | nodejs:24-9080020260626074955.rhel9 | fixed | RHSA-2026:35891 |
| Red Hat Enterprise Linux 9 | nodejs:22-9080020260626075442.rhel9 | fixed | RHSA-2026:35892 |
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | affected | |
| Red Hat Enterprise Linux 8 | nodejs:24-8100020260630152626.6d880403 | fixed | RHSA-2026:39868 |
| Red Hat Enterprise Linux 8 | nodejs:22-8100020260703140402.6d880403 | fixed | RHSA-2026:41947 |
| Red Hat Enterprise Linux 10 | nodejs24-1:24.18.0-1.el10_2 | fixed | RHSA-2026:35841 |
| Red Hat Enterprise Linux 10 | nodejs22-1:22.23.1-2.el10_2 | fixed | RHSA-2026:35842 |
| Red Hat Enterprise Linux 10 | nodejs26 | affected | |
| Debian 12 (bookworm) | nodejs | fixed | 18.20.4+dfsg-1~deb12u3 (DLA-4809-1) |
| Debian 13 (trixie) | nodejs | fixed | 20.19.2+dfsg-1+deb13u3 (DSA-6517-1) |
| RHEL 8 (nodejs:22 module) | nodejs | fixed | 1:22.23.1-1.module+el8.10.0+24500+8eb51621 (RHSA-2026:41947) |
| RHEL 8 (nodejs:24 module) | nodejs | fixed | 1:24.18.0-1.module+el8.10.0+24481+7a71fac8 (RHSA-2026:39868) |
| RHEL 9 (nodejs:22 module) | nodejs | fixed | 1:22.23.1-1.module+el9.8.0+24457+996af7aa (RHSA-2026:35892) |
| RHEL 9 (nodejs:24 module) | nodejs | fixed | 1:24.18.0-1.module+el9.8.0+24456+b244c3b4 (RHSA-2026:35891) |
| RHEL 10 | nodejs22 | fixed | 1:22.23.1-2.el10_2 (RHSA-2026:35842) |
| RHEL 10 | nodejs24 | fixed | 1:24.18.0-1.el10_2 (RHSA-2026:35841) |
| RHEL 9 (nodejs:26 module) / RHEL 10 nodejs26 | nodejs / nodejs26 | fixed | no fix yet (Red Hat: Affected, 2026-11-03) |
| Alpine 3.22 | nodejs | fixed | 22.23.0-r0 (secdb) |
| Alpine 3.23 | nodejs | fixed | 24.17.0-r0 (secdb) |
| Alpine 3.24 | nodejs | fixed | 24.17.0-r0 (secdb) |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
If you cannot patch yet
- Only reachable when untrusted input of 2 GiB (or a multiple) reaches crypto.subtle.encrypt() (Node.js advisory); Node.js publishes no other workaround.
- Node.js 20.x reached end-of-life on 2026-04-30 and 25.x on 2026-06-01; supported lines on 2026-11-03 are 22.x and 24.x (Maintenance LTS) and 26.x (Active LTS). End-of-life lines get no further fixes.
Related vulnerabilities
Sources
- Node.js security releases, June 18, 2026
- CVE record CVE-2026-48933
- NVD: CVE-2026-48933
- GitHub advisory GHSA-pvpp-9x2p-fxg3 (CVE-2026-48933)
- Debian security tracker: CVE-2026-48933
- Ubuntu CVE tracker: CVE-2026-48933
- Red Hat CVE page: CVE-2026-48933
- Alpine secdb (v3.22/v3.23/v3.24 main + community)
- Node.js release status (previous releases)
- https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.