Описание
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing.
Отчет
This Moderate flaw in Node.js allows mutual TLS (mTLS) client identities to be reused across requests due to a connection reuse issue within the HTTPS Agent. This can lead to unintended identity confusion if applications are configured to use different client certificates with reused connections, potentially enabling unauthorized access within the mTLS context.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | nodejs26 | Affected | ||
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | Affected | ||
| Red Hat Hardened Images | nodejs20 | Will not fix | ||
| Red Hat Hardened Images | nodejs25 | Will not fix | ||
| Red Hat Enterprise Linux 10 | nodejs22 | Fixed | RHSA-2026:61376 | 31.08.2026 |
| Red Hat Enterprise Linux 10 | nodejs24 | Fixed | RHSA-2026:61377 | 31.08.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | nodejs22 | Fixed | RHSA-2026:64817 | 08.09.2026 |
| Red Hat Enterprise Linux 8 | nodejs | Fixed | RHSA-2026:62219 | 01.09.2026 |
| Red Hat Enterprise Linux 8 | nodejs | Fixed | RHSA-2026:62583 | 02.09.2026 |
| Red Hat Enterprise Linux 9 | nodejs | Fixed | RHSA-2026:61383 | 31.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.1 Medium
CVSS3
Связанные уязвимости
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-ar ...
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
EPSS
4.1 Medium
CVSS3