CVE-2026-123877

A certificate validation bypass exists in the Node.js https.Agent component affecting versions 26.x , 24.x , and 22.x . The vulnerability arises because https.Agent.prototype.getName() assigns the same session-cache key to requests that omit the ca property and those that explicitly provide ca: [...

CVE-2026-123877 Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse

A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName assigns the same Agent and session-cache key to a request that omits ca and one that explicitly...

Node.js < 22.23.5, < 24.22.3, < 26.13.1 - Improper Certificate Validation via an https.Agent Session Cache Key Collision Between Omitted and Empty ca leading to Cross-Policy Session Reuse

Improper Certificate Validation via an https.Agent Session Cache Key Collision Between Omitted and Empty ca leading to Cross-Policy Session Reuse vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...