CVE-2026-56850

Overview

Node.js is a JavaScript runtime built on the V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used to build scalable server-side and networking applications.

An improper authentication vulnerability (CVE-2026-56850) has been identified in the Node.js HTTPS Agent, where connection reuse can cause pfx object-array key collisions. Requests configured with different client certificates can be mapped to the same pooled connection, so a mutual TLS (mTLS) client identity can be reused across requests that asked for a different one.

Per MITRE, CWE-287, Improper Authentication, applies "when an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct." Here the identity presented to the remote server is a valid one; it is simply not the identity the calling code selected for that request.

This issue affects all users on the active 26.x, 24.x, and 22.x release lines below the patched versions. The End-of-Life 12.x, 14.x, 16.x, 18.x, and 20.x lines are affected as well and received a post-EOL security fix under Node.js NES. The issue is tracked in GitHub Security Advisory GHSA-777r-4cwx-g26v.

Details

Module Info

• Product: Node.js
• Affected packages: nodejs/node (the Node.js runtime itself)
• Affected versions:
  • <=26.5.0
  • <=24.18.0
  • <=22.23.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://github.com/nodejs/node/releases
• GitHub Security Advisory: GHSA-777r-4cwx-g26v
• Package manager: n/a (Node.js ships as a runtime distribution rather than a registry package)
• Fixed in: Node.js NES v12.22.20, v14.21.13, v16.20.14, v18.20.19, and v20.20.4. The 14.x, 16.x, 18.x, and 20.x NES releases shipped on August 3, 2026; the 12.x NES release shipped on August 11, 2026.

Vulnerability Info

This Medium-severity vulnerability is found in the https.Agent implementation of the Node.js runtime, in every release below the patched version of each line.

The HTTPS Agent pools sockets so that repeated requests to the same endpoint can reuse an established TLS connection. Sockets are grouped by a name the agent derives from the request options, and every TLS setting that changes the identity of the connection is supposed to contribute to that name, including the client credentials passed as cert, key, or pfx. Two requests share a pooled socket only when their names match, and the same name also keys the agent’s TLS session cache.

The pfx option accepts an array of objects, each holding a PKCS#12 buffer and its passphrase. In affected versions the agent appended that value to the name directly, so an array of objects was converted to a string that carries none of the identifying content. Two different client identities supplied that way therefore produced the same name. Requests that asked for different client certificates landed in the same pool, and a keep-alive socket already authenticated with one identity could serve a request configured with another.

The upstream fix (commit 9f03017f38, "https: distinguish PFX object-array agent keys") builds the name from the contents of each array entry instead:

function getPfxAgentKey(pfx, passphrase) {
  if (!ArrayIsArray(pfx))
    return pfx;

  let key = '';
  for (let i = 0; i < pfx.length; i++) {
    const value = pfx[i];
    const raw = value?.buf || value;
    const pass = value?.passphrase || passphrase;
    key += `:${raw}:${pass}`;
  }
  return key;
}

Distinct PFX entries now produce distinct names, so the connections and cached TLS sessions no longer collide.

The two published CVSS vectors both record the impact as integrity only, with no confidentiality or availability impact, and both score the attack vector as local with high privileges required. That reflects an attacker who can already influence the requesting process’s own configuration rather than a remote one. The practical consequence for an affected application is that a request may be presented to the remote server under a client identity other than the one selected for it.

Note: The collision arises specifically when pfx is given as an array of objects. Client credentials supplied as cert and key, or as a single PFX buffer, already contribute their own content to the agent name.

Mitigation

The Node.js 12.x, 14.x, 16.x, 18.x, and 20.x release lines are End-of-Life and will not receive an upstream fix for this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js release line at or above the patched version (22.23.2, 24.18.1, or 26.5.1).
• Migrate affected applications away from the End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support (Node.js NES).

Credits

• yottt (reporter)
• RafaelGSS (remediation developer)