CVE-2026-489337.5HighCWE-190
nodejs node vulnerability
nodejs · node
Not in CISA KEVVendor fix available
3.7%probability of exploitation in the next 30 days
89th percentile
050100
Higher than 89% of scored CVEs
7.5HighCVSS 3.0
LowMediumHighCrit.
DescriptionNVD
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 18 Jun.
- Node.js fixes critical WebCrypto TLS flaws in urgent updateSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.