CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://nodejs.org/en/blog/vulnerability/july-2026-security-releases	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nodejs:node.js:::::-:::*
	cpe:2.3:a:nodejs:node.js:::::-:::*
	cpe:2.3:a:nodejs:node.js:::::-:::*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Un fallo en la reutilización de conexiones del Agente HTTPS de Node.js puede causar colisiones de claves de array de objetos PFX, permitiendo que las identidades de cliente de TLS mutuo (mTLS) sean reutilizadas entre solicitudes configuradas con diferentes certificados de cliente. Esta vulnerabilidad afecta a Node.js 26.x, 24.x, y 22.x.

Information

Published : 2026-07-30 06:25

Updated : 2026-10-23 22:10

NVD link : CVE-2026-56850

Mitre link : CVE-2026-56850

CVE.ORG link : CVE-2026-56850

JSON object : View

Products Affected

nodejs

node.js

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-56850", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56850", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T12:37:02.406813Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.5}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "nodejs", "product": "node", "versions": [{"status": "affected", "version": "26.5.0", "versionType": "semver", "lessThanOrEqual": "26.5.0"}, {"status": "affected", "version": "24.18.0", "versionType": "semver", "lessThanOrEqual": "24.18.0"}, {"status": "affected", "version": "22.23.1", "versionType": "semver", "lessThanOrEqual": "22.23.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T06:25:55.073", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.\r\n\r\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."}, {"lang": "es", "value": "Un fallo en la reutilizaci\u00f3n de conexiones del Agente HTTPS de Node.js puede causar colisiones de claves de array de objetos PFX, permitiendo que las identidades de cliente de TLS mutuo (mTLS) sean reutilizadas entre solicitudes configuradas con diferentes certificados de cliente.\n\nEsta vulnerabilidad afecta a Node.js 26.x, 24.x, y 22.x."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "5D5BDB63-A6E1-4131-8920-02D17B6E68E5", "versionEndIncluding": "22.23.1", "versionStartIncluding": "22.0"}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "9354DDC1-01A6-4F46-85A8-4A21C1A41E1F", "versionEndIncluding": "24.18.0", "versionStartIncluding": "24.0.0"}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "B2A6EA1C-9CE0-4F3F-8ED2-C3646F5DB630", "versionEndIncluding": "26.5.0", "versionStartIncluding": "26.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}