A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Node.js | Nodejs | 22.0 (including) | 22.23.1 (including) |
| Node.js | Nodejs | 24.0.0 (including) | 24.18.0 (including) |
| Node.js | Nodejs | 26.0.0 (including) | 26.5.0 (including) |
| Red Hat Enterprise Linux 10 | RedHat | nodejs22-1:22.23.2-1.el10_2 | * |
| Red Hat Enterprise Linux 10 | RedHat | nodejs24-1:24.19.0-1.el10_2 | * |
| Red Hat Enterprise Linux 10.0 Extended Update Support | RedHat | nodejs22-1:22.23.2-1.el10_0 | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:22-8100020260819113925.6d880403 | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:24-8100020260819113942.6d880403 | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs:22-9080020260819113937.rhel9 | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs:24-9080020260819113946.rhel9 | * |
| Red Hat Enterprise Linux 9.6 Extended Update Support | RedHat | nodejs:22-9060020260901085634.rhel9 | * |
| Red Hat Hardened Images | RedHat | nodejs26-main-11.17.0-1.26.5.1.1.5.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs26-main-26.5.1-1.5.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs22-main-10.9.8-1.22.23.2.2.3.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs22-main-22.23.2-2.3.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs24-main-11.16.0-1.24.18.1.0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs24-main-24.18.1-0.1.hum1 | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html