Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-30T06:02:50 nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N CWE-303

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing.

This Moderate flaw in Node.js allows mutual TLS (mTLS) client identities to be reused across requests due to a connection reuse issue within the HTTPS Agent. This can lead to unintended identity confusion if applications are configured to use different client certificates with reused connections, potentially enabling unauthorized access within the mTLS context. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48273 nodejs26-main-26.5.1-1.5.hum1 Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48305 nodejs22-main-22.23.2-2.3.hum1 Red Hat Hardened Images 2026-07-30T00:00:00Z RHSA-2026:48537 nodejs24-main-24.18.1-0.1.hum1 Red Hat Enterprise Linux 10 Fix deferred nodejs22 Red Hat Enterprise Linux 10 Fix deferred nodejs24 Red Hat Enterprise Linux 8 Fix deferred nodejs:22/nodejs Red Hat Enterprise Linux 8 Fix deferred nodejs:24/nodejs Red Hat Enterprise Linux 9 Fix deferred nodejs:22/nodejs Red Hat Enterprise Linux 9 Fix deferred nodejs:24/nodejs Red Hat Hardened Images Fix deferred nodejs20 Red Hat Hardened Images Fix deferred nodejs25 https://www.cve.org/CVERecord?id=CVE-2026-56850 https://nvd.nist.gov/vuln/detail/CVE-2026-56850 https://nodejs.org/en/blog/vulnerability/july-2026-security-releases