A flaw in Node.js TLS hostname handling permits the insertion of embedded NUL characters in hostnames, which causes C‑string truncation in resolver bindings. This silent authority rebinding bypasses normal hostname verification, enabling an attacker to impersonate the intended server during TLS connections. The weakness corresponds to CWE‑284 and CWE‑170, indicating insecure permission handling and improper handling of null characters during hostname processing.

Node.js versions 22, 24, and 26 are all affected. The defect resides in the core TLS implementation bundled with Node.js and may impact any application that creates HTTPS/TLS client connections with hostname validation enabled.

The CVSS score of 5.6 indicates medium severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, which suggests no publicly known exploitation. Based on the description, the likely attack vector is network‑based, where a malicious server sends a TLS request that includes an embedded NUL. If the victim application accepts the truncated hostname, the attacker could hijack the TLS session endpoint without detection.