54 matches found
CVE-2026-56850
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-56850
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-56850
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-56850
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-56850: Improper Authentication
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
PT-2026-66408
Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the Node.js HTTPS Agent connection reuse mechanism can lead to PFX object-array key collisions. This issue allows mutual TLS mTLS client identities to be...
nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...
Node.js 22.x < 22.23.2 / 24.x < 24.18.1 / 26.x < 26.5.1 Multiple Vulnerabilities (Wednesday, July 29, 2026 Security Releases).
The version of Node.js installed on the remote host is prior to 22.23.2, 24.18.1, 26.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, July 29, 2026 Security Releases advisory. - A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a...
Node.js: HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates
A flaw in Node.js HTTPS Agent connection reuse was discovered that could cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affected Node.js versions 26.x, 24.x, and 22.x...
Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets
Cybersecurity researchers have discovered a malicious NuGet package that masquerades as a C software development kit for Sicoob, one of Brazil's largest cooperative financial systems, to siphon client IDs and PFX certificates. According to Socket, versions 2.0.0 through 2.0.4 of "Sicoob.Sdk"...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005421)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005421 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix Oops by 9.1 surround channel names getlineoutpfx may trigger an Oops by overflowin...
OpenSSL Security Advisory Assessment, January 2026
OpenSSL Security Advisory Assessment, January 2026 Summary The OpenSSL project released a security advisory that includes 12 CVEs. After assessment, we have concluded that three CVEs affect Node.js severity Low to Moderate. Given the limited attack surface, the OpenSSL updates will be included in...
How to convert PFX certificate without importing password to PEM certificate on ADC
This article provides instruction on how toconvert PFX certificate with importing password to PEM certificate in our document using "Import PKCS12" on GUI. Refer to...
Backup Fails With the Error “PKCS12 (PFX)”
Challenge A backup job fails with the error: PKCS12 PFX without a supplied password has exceeded maximum allowed iterations. See https://go.microsoft.com/fwlink/?linkid=2233907 for more information The issue may also manifest as a backup job being stuck in the queued state. In this specific case,...
ICPR Certificate Management
Request certificates via MS-ICPR Active Directory Certificate Services. Depending on the certificate template's configuration the resulting certificate can be used for various operations such as authentication. PFX certificate files that are saved are encrypted with a blank password. This module ...
Masky - Python Library With CLI Allowing To Remotely Dump Domain User Credentials Via An ADCS Without Dumping The LSASS Process Memory
Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope. This tool does not exploit any new vulnerability and...
Citrix ADC - Error: "Invalid private key, or PEM pass phrase required for this private key" on FIPS device
When trying to export a PFX file from a certificate that has already been uploaded to the ADC, we get the error "Invalid private key, or PEM pass phrase required for this private key" , even after making sure the correct certificate and private key is selected, as well as entering the correct...
CVE-2021-1731
PFX Encryption Security Feature Bypass Vulnerability...
