CVE-2026-56850

Published: Jul 30, 2026Modified: Aug 25, 2026

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Exploitability: 0.8 / Impact: 3.6

Source: NVD

Description

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Affected (3)

Products: Nodejs: Node.js

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 22.0 to 22.23.1
Nodejs Node.js	From 24.0.0 to 24.18.0
Nodejs Node.js	From 26.0.0 to 26.5.0

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (1)

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Source: support@hackerone.com

Vendor Advisory

Timeline

No history available yet.