CVE-2026-56850: Medium severity Node.js Node.js vulnerability
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56850?
The severity of CVE-2026-56850 is rated as medium with a CVSS score of 4.1.
How does CVE-2026-56850 affect Node.js?
CVE-2026-56850 affects Node.js versions 26.x, 24.x, and 22.x by allowing PFX object-array key collisions.
What is the impact of the CVE-2026-56850 vulnerability?
The impact of CVE-2026-56850 includes the potential reuse of mutual TLS (mTLS) client identities across different requests.
How do I mitigate CVE-2026-56850?
To mitigate CVE-2026-56850, update to a patched version of Node.js that resolves this vulnerability.
Is CVE-2026-56850 exploitable in all configurations?
CVE-2026-56850 is exploitable in configurations where different client certificates are used on the same HTTPS Agent.