Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-30T06:02:49 nodejs: HTTPS Agent TLS session reuse skips hostname verification 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CWE-322

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security (TLS) sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to information disclosure or other security breaches.

This issue is rated Moderate (CVSS 6.3) because successful exploitation allows session-hijacking and information disclosure without affecting system integrity or availability (C:H, I:N, A:N). The flaw occurs when an HTTPS Agent reuses an existing TLS session across requests with differing identity policies, skipping host verification. An attacker must already sit in a privileged network position (AV:N/AC:H) to perform a man-in-the-middle attack and intercept traffic intended for a distinct target on the same TLS session. Applications that explicitly configure unique HTTPS agents per target host, avoid TLS session caching, or do not make outbound HTTPS requests to varied third-party endpoints using shared client instances are not at risk. To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes. Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48273 nodejs26-main-26.5.1-1.5.hum1 Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48305 nodejs22-main-22.23.2-2.3.hum1 Red Hat Hardened Images 2026-07-30T00:00:00Z RHSA-2026:48537 nodejs24-main-24.18.1-0.1.hum1 Red Hat Enterprise Linux 10 Fix deferred nodejs22 Red Hat Enterprise Linux 10 Fix deferred nodejs24 Red Hat Enterprise Linux 8 Fix deferred nodejs:22/nodejs Red Hat Enterprise Linux 8 Fix deferred nodejs:24/nodejs Red Hat Enterprise Linux 9 Fix deferred nodejs:22/nodejs Red Hat Enterprise Linux 9 Fix deferred nodejs:24/nodejs Red Hat Hardened Images Will not fix nodejs20 Red Hat Hardened Images Will not fix nodejs25 https://www.cve.org/CVERecord?id=CVE-2026-58040 https://nvd.nist.gov/vuln/detail/CVE-2026-58040 https://nodejs.org/en/blog/vulnerability/july-2026-security-releases