CVE-2026-56850CWE-287

CVE-2026-56850

Medium · published July 30, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
0.2
In the wild
Unconfirmed
What it is

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00084 · 0.2th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-07-30T10:25Z
Affected products (3)
ProductVersionsFixed in
nodejs/node.js≥ 22.0, ≤ 22.23.1—
nodejs/node.js≥ 24.0.0, ≤ 24.18.0—
nodejs/node.js≥ 26.0.0, ≤ 26.5.0—
References (1)
https://nodejs.org/en/blog/vulnerability/july-2026-security-releases · [email protected]
EPSS history
Timeline
  • 30 JUL 06:02Z
    A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across…
    cvelistv5