Executive brief
Node.js is a popular runtime environment used to build and run server-side applications. A security flaw has been identified where the system may fail to properly verify the identity of a remote server when reusing encrypted connections. This could allow an attacker to intercept or redirect sensitive data by tricking the application into communicating with an unauthorized server it believes is trusted.
Technical details
This vulnerability is an incomplete fix for CVE-2026-48934 within the Node.js HTTPS Agent. When TLS sessions are reused, the agent may fail to perform necessary hostname verification across different identity policies. An attacker with low privileges could potentially exploit this flaw over the network, though the attack complexity is high as it requires specific session reuse conditions. This could lead to a breach of confidentiality by allowing connections to be established with incorrect or malicious hosts. The issue is addressed in Node.js versions 22.23.2, 24.18.1, and 26.5.1.
Affected products
- Node.js Node.js 22.x, 24.x, 26.x
Timeline
- 2026-07-29: patched: Security releases v22.23.2, v24.18.1, and v26.5.1 made available.
- 2026-07-30: disclosed: NVD publication date.