# CVE-2026-123877: Node.js https.Agent certificate validation bypass via TLS session reuse

Source: https://junglewise.ai/threats/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-123877 · Severity: medium · CVSS 6.8 · Published 2026-11-11

Node.js https.Agent, used by applications to manage HTTPS connections, caches TLS sessions for performance. A bug allows a session authenticated under one CA policy to be reused for requests with a stricter policy, enabling an attacker to bypass certificate validation and transmit confidential data to servers that would normally be rejected.

Technologies: [OpenJS Foundation Node.js](https://junglewise.ai/threats/technologies/openjs-foundation-node-js). Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-123877 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123877 being exploited in the wild.

**How severe is CVE-2026-123877?** Medium severity, with a CVSS score of 6.8, published 11 November 2026.

**Which products and versions are affected?** OpenJS Foundation Node.js 26.x, 24.x, 22.x.

**Is there a fix for CVE-2026-123877?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123877 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123877?** Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A flaw in https.Agent.prototype.getName() assigns identical cache keys to HTTPS requests regardless of whether the ca parameter is omitted (using the default trust store) or explicitly set to an empty array (using no CAs). When TLS 1.3 session resumption reuses a cached session, the earlier authentication under the broader policy is applied to the stricter policy, causing authorized === true despite the new request's own CA rules rejecting the server. Network-level attack requiring the victim application to make sequential HTTPS requests with differing CA policies.

## Affected products

- OpenJS Foundation Node.js 26.x, 24.x, 22.x

## Timeline

- 2026-11-11: disclosed

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://nodejs.org/en/blog/vulnerability/november-2026-security-releases](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases)

## Related threats

- [Node.js TLS server use-after-destroy in deferred handshake callbacks](https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server)
- [Node.js HTTP/2 denial of service via NULL pointer dereference](https://junglewise.ai/threats/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an)
- [Node.js HTTP/2 use-after-free in respondWithFile stream reset](https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated)
- [Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a)
- [Node.js proxy credential disclosure in ERR_PROXY_INVALID_CONFIG](https://junglewise.ai/threats/cve-2026-123871-node-js-discloses-proxy-credentials-in-err-proxy-invalid-config)