nodejs: Node.js: Mutual TLS authorization bypass via incomplete SNI context configuration

A flaw was found in Node.js. When a Transport Layer Security TLS server configures a host-specific client Certificate Authority CA without providing an associated server certificate, the per-host client validation settings fail to apply. Consequently, the connection silently falls back to trustin...

nodejs: Node.js: Mutual TLS authorization bypass via incomplete SNI context configuration

A flaw was found in Node.js. When a Transport Layer Security TLS server configures a host-specific client Certificate Authority CA without providing an associated server certificate, the per-host client validation settings fail to apply. Consequently, the connection silently falls back to trustin...

CVE-2026-123867 Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA

A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContexthost, ca: protectedCA but no server certificate...

CVE-2026-123867

Node.js versions 26.x, 24.x, and 22.x are vulnerable to a per-host mTLS authorization bypass . The root cause is located in src/crypto/crypto_tls.cc, where CertCbDone fails to install a specific client-certificate CA in a CA-only SNI context if the setSniContext returns false (which happens when ...

PT-2026-145389

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 22.23.5 Node.js versions prior to 24.22.3 Node.js versions prior to 26.13.1 Description A per-host mutual-TLS mTLS authorization bypass occurs when a TLS server assigns a different client-certificate CA using...

Node.js < 22.23.5, < 24.22.3, < 26.13.1 - Incorrect Authorization via CA-Only SNI Contexts Failing Open to the Default Client CA leading to Per-Host mTLS Bypass

Incorrect Authorization via CA-Only SNI Contexts Failing Open to the Default Client CA leading to Per-Host mTLS Bypass vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...

EUVD-2026-63095

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext...

SUSE CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

UBUNTU-CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CLSA-2026-1783675292 nodejs: Fix of 4 CVEs

CVE-2026-48930: reject hostnames with embedded NUL bytes in dns.lookup and net.connect to prevent silent authority rebinding - CVE-2026-48619: cap the HTTP/2 client ORIGIN set size to prevent unbounded memory growth - CVE-2026-48618: normalize hostname to ASCII for TLS server identity checks -...