node-cve-2026-58040-check

Tests node-cve-2026-58040-check Offline evidence checker for CVE-2026-58040 — Node.js: HTTPS Agent TLS session identity-policy bypass. It compares operator-reported Node.js runtime versions with the fixed releases named in the vendor advisory and writes a CSV, JSON or script-free HTML triage...

node-cve-2026-56850-check

node-cve-2026-56850-check Offline evidence checker for CVE-2026-56850 — Node.js: HTTPS Agent PFX client identity collision. It compares Node.js runtime versions that an operator reports against the fixed releases named in the Node.js security advisory, and writes the result as CSV, JSON or...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

Node.js 26.5.0 HTTPS Agent Session Reuse Verification Bypass

Node.js versions before 22.23.2, 24.18.1, and 26.5.1 contain an HTTPS Agent TLS session reuse flaw that can skip hostname verification across identity policies. This offline checker assesses supplied version evidence and does not test exploitability. https://packetstorm.news/download/237495...

Node.js 26.5.0 HTTPS Agent PFX Client Identity Collision

Node.js versions 22.x, 24.x, and 26.x contain an HTTPS Agent connection reuse flaw that can reuse mutual TLS client identities across requests configured with different PFX client certificates. The supplied tool performs offline comparison of operator-reported versions against fixed releases...

Node.js 26.5.0 HTTPS Agent TLS Session Reuse Hostname Verification Bypass

Node.js versions 22.x, 24.x, and 26.x prior to 22.23.2, 24.18.1, and 26.5.1 respectively contain an HTTPS Agent TLS session reuse issue that can skip hostname verification across identity policies. This advisory provides research and an implementation checklist; it contains no checker...

Node.js 26.5.0 HTTPS Agent PFX Client Identity Collision

Node.js versions 22.x, 24.x, and 26.x contain an HTTPS Agent PFX object-array key collision that can reuse mTLS client identities across requests configured with different client certificates...

Exploit for CVE-2026-58040

node-cve-2026-58040-check Standalone...

Exploit for Improper Authentication in Nodejs Node.Js

node-cve-2026-56850-check Standalon...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...