Executive brief
A flaw in Node.js can cause the software to incorrectly reuse security credentials when making secure web connections. This could allow a connection intended for one user or service to be mistakenly identified as another, potentially bypassing security checks that rely on client certificates. This affects applications using mutual TLS (mTLS) for identity verification.
Technical details
A vulnerability in the Node.js HTTPS Agent's connection pooling mechanism arises from PFX object-array key collisions during connection reuse. When multiple requests are configured with different PFX-based client certificates, the agent may fail to distinguish between them, leading to the reuse of an existing mTLS connection associated with a different identity. This improper authentication flaw (CWE-287) allows for identity impersonation across requests. The issue affects Node.js versions 22.x, 24.x, and 26.x and has been addressed in security releases v22.23.2, v24.18.1, and v26.5.1.
Affected products
- Node.js Node.js 22.x, 24.x, 26.x
Timeline
- 2026-07-29: patched: Security releases v22.23.2, v24.18.1, and v26.5.1 published.
- 2026-07-30: disclosed: CVE-2026-56850 published to NVD.