Vulnerability Details CVE-2026-48933
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 43.0%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-48933
-
cpe:2.3:a:nodejs:node.js:22.22.3
-
cpe:2.3:a:nodejs:node.js:24.16.0
-
cpe:2.3:a:nodejs:node.js:26.3.0