{"vulnerability": "CVE-2026-48933", "sightings": [{"uuid": "9b4c1ddd-28e2-4aa5-baef-cd94354bd3ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://bsky.app/profile/canartuc.com/post/3mon66r4i6w2y", "content": "Node.js fixed 13 CVEs across 22.23.0, 24.17.0 and 26.3.1. The two HIGH-rated ones stand out: a WebCrypto AES integer overflow (CVE-2026-48933) that aborts the process, and a TLS authentication bypass (CVE-2026-48618). Is your CI pinned to a patched minor yet?\n\n#nodejs", "creation_timestamp": "2026-06-19T10:48:46.622778Z"}, {"uuid": "8c9fd8b6-47b2-4dc5-9ec1-4d5c7bc261f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c", "content": "\ud83d\udd17 CVE : CVE-2026-21636, CVE-2026-48615, CVE-2026-48617, CVE-2026-48618, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48931, CVE-2026-48933, CVE-2026-48934, CVE-2026-48935, CVE-2026-48936, CVE-2026-48937", "creation_timestamp": "2026-06-19T13:45:18.313785Z"}, {"uuid": "65930e07-941a-445f-b7e1-4d989341cc2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3motlougng225", "content": "Node.js\u30012026\u5e746\u6708\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30ea\u30fc\u30b9\u306712\u4ef6\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63(CVE-2026-48933,CVE-2026-48618)\u4ed6\n\nrocket-boys.co.jp/security-mea...\n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews", "creation_timestamp": "2026-06-22T00:06:27.079098Z"}, {"uuid": "95dc9194-0200-442e-9765-c4fa00395e2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T19:00:00.000000Z"}, {"uuid": "2e759e89-9722-4ff8-abae-3350145970ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp5vjkhvop2u", "content": "CVE-2026-48933 - Node.js WebCrypto Denial of Service\nCVE ID : CVE-2026-48933\n \n Published : June 26, 2026, 1:14 a.m. | 30\u00a0minutes ago\n \n Description : A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.\n\nTh...", "creation_timestamp": "2026-06-26T02:29:00.087404Z"}, {"uuid": "d27b5ca8-b7e3-4552-af25-bb7987a26943", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48933", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mp64cqknvp2o", "content": "Node.js WebCrypto (v22.22.3, 24.16.0, 26.3.0) faces a HIGH severity bug \u2014 CVE-2026-48933. Integer overflow in subtle.encrypt() can crash Node.js with 2 GiB+ input. Avoid large inputs & watch for patches. \ud83d\udeab https://radar.offseq.com/threat/cve-2026-48933-cwe-190-integer-overflow-in-nodejs--5c33db78...", "creation_timestamp": "2026-06-26T04:30:28.498694Z"}, {"uuid": "91ac0e7a-e79d-4bd2-a8ff-0aa4f896c93f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48933", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116814526921125903", "content": "Node.js WebCrypto in v22.22.3, v24.16.0, v26.3.0 is affected by CVE-2026-48933 (HIGH). Integer overflow in subtle.encrypt() can crash processes with inputs \u2265 2 GiB, causing DoS. Avoid large inputs while awaiting a fix. \ud83d\udd10 https://radar.offseq.com/threat/cve-2026-48933-cwe-190-integer-overflow-in-nodejs--5c33db78fed81dbe #OffSeq #Nodejs #Vuln", "creation_timestamp": "2026-06-26T04:30:31.789409Z"}, {"uuid": "238aa55c-fbbb-42b8-b686-ad3c2a60a6c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mquvxltxdc2s", "content": "\u300cNode.js\u300d\u306b12\u4ef6\u306e\u8106\u5f31\u6027 - \u4fee\u6b63\u7248\u3092\u516c\u958b\n\n\u300cNode.js\u300d\u306b\u8907\u6570\u306e\u8106\u5f31\u6027\u304c\u5224\u660e\u3057\u3001\u958b\u767a\u30c1\u30fc\u30e0\u306f\u73fe\u5730\u6642\u95932026\u5e746\u670818\u65e5\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u300cNode.js 26.3.1\u300d\u300c\u540c24.17.0\u300d\u300c\u540c22.23.0\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u3002\n\n...\n\n\u300cCVE-2026-48933\u300d\u306f\u3001\u300cWebCrypto\u300d\u306b\u304a\u3051\u308b\u5b9f\u88c5\u306e\u4e0d\u5099\u306b\u3088\u308a\u3001AES\u51e6\u7406\u306b\u304a\u3044\u3066\u6574\u6570\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u304c\u751f\u3058\u3001\u30d7\u30ed\u30bb\u30b9\u304c\u30af\u30e9\u30c3\u30b7\u30e5\u3059\u308b\u8106\u5f31\u6027\u3002\u307e\u305f\u3001Unicode\u30c9\u30c3\u30c8\u533a\u5207\u308a\u6587\u5b57\u306e\u51e6\u7406\u306b\u8d77\u56e0\u3059\u308bTLS\u306e\u30db\u30b9\u30c8\u540d\u51e6\u7406\u306b\u554f\u984c\u304c\u3042\u308a\u3001\u30ef\u30a4\u30eb\u30c9\u30ab\u30fc\u30c9\u8a3c\u660e\u66f8\u306e\u691c\u8a3c\u304c\u56de\u907f\u3055\u308c\u308b\u300cCVE-2026-48618\u300d\u3092\u4fee\u6b63\u3057\u3066\u3044\u308b\u3002", "creation_timestamp": "2026-07-17T23:33:18.524489Z"}]}