Executive brief
A security flaw in Node.js could allow an attacker to bypass standard security checks when establishing encrypted connections. This occurs when a secure session is reused with a different server name, potentially allowing unauthorized connections to be treated as trusted. This could lead to the exposure of sensitive data or unauthorized access to services relying on Node.js for secure communication.
Technical details
A vulnerability in the Node.js TLS implementation allows for a host identity verification bypass. The flaw occurs during TLS session reuse; specifically, when a session is resumed using a different 'servername' than the original session, Node.js may fail to properly re-validate the host identity against the certificate. This allows an attacker to potentially establish unauthorized connections by leveraging previously authenticated sessions. The issue affects Node.js release lines 22, 24, and 26, and has been addressed in versions 22.23.0, 24.17.0, and 26.3.1.
Affected products
- Node.js Node.js 22.x, 24.x, 26.x
Timeline
- 2026-06-18: patched: Security releases v22.23.0, v24.17.0, and v26.3.1 made available.
- 2026-06-26: disclosed: CVE published to NVD.