ALPINE-CVE-2026-123872: High severity alpine/nodejs vulnerability
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.13.1-r0
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this bypass?
Servers using affected Node.js 26.x, 24.x, or 22.x are exposed when they apply different client-certificate authentication policies by hostname on the same TLS service. A notable example is a less-restricted host and an admin host requiring stricter client-certificate authentication.
What does an attacker need to exploit the issue?
The attacker needs a client certificate accepted for a permitted hostname and must be able to perform TLS 1.2 renegotiation. They then change the servername during renegotiation so the existing authentication is carried to a hostname protected by a stricter policy.
Is a server with ordinary client-certificate authentication on only one hostname affected?
The described bypass depends on differing client-certificate policies between hostnames. The provided information does not indicate exposure for a deployment that has only one hostname or does not distinguish client-certificate authorization by hostname.