HIGHFixed upstream

CVE-2026-48933

Node.js: WebCrypto AES integer overflow crashes the process

Technology

Node.js

CVSS Score

7.5 / 10.0

Affected Versions

Node.js 22, 24 and 26 before the June 2026 releases

Upstream Fix

22.23.0; 24.17.0; 26.3.1

Published

June 26, 2026

OSSeva Coverage

Fixed upstream

Description

If the input to subtle.encrypt() is a multiple of 2 GiB, an integer overflow in the WebCrypto AES implementation aborts the process, a remote denial of service. Rated High by Node.js. Fixed in the June 2026 security releases: 22.23.0, 24.17.0 and 26.3.1.

Upstream record: NVD · CVE.org

Is your Node.js deployment affected?

If you're running Node.js 22, 24 and 26 before the June 2026 releases, you need this patch. Book a discovery call to get covered.

Book a discovery call View Node.js coverage →