cve-2026-56850

{
  "cvss": 4.4,
  "datePublished": "2026-07-30T06:25:55.073",
  "dateUpdated": "2026-10-23T22:10:00.160",
  "description": "A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.\r\n\r\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
  "id": "CVE-2026-56850",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "node",
            "vendor": "nodejs",
            "versions": [
              {
                "lessThanOrEqual": "26.5.0",
                "status": "affected",
                "version": "26.5.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "24.18.0",
                "status": "affected",
                "version": "24.18.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "22.23.1",
                "status": "affected",
                "version": "22.23.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "support@hackerone.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "5D5BDB63-A6E1-4131-8920-02D17B6E68E5",
                "versionEndIncluding": "22.23.1",
                "versionStartIncluding": "22.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9354DDC1-01A6-4F46-85A8-4A21C1A41E1F",
                "versionEndIncluding": "24.18.0",
                "versionStartIncluding": "24.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "B2A6EA1C-9CE0-4F3F-8ED2-C3646F5DB630",
                "versionEndIncluding": "26.5.0",
                "versionStartIncluding": "26.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.\r\n\r\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."
      },
      {
        "lang": "es",
        "value": "Un fallo en la reutilización de conexiones del Agente HTTPS de Node.js puede causar colisiones de claves de array de objetos PFX, permitiendo que las identidades de cliente de TLS mutuo (mTLS) sean reutilizadas entre solicitudes configuradas con diferentes certificados de cliente.\n\nEsta vulnerabilidad afecta a Node.js 26.x, 24.x, y 22.x."
      }
    ],
    "id": "CVE-2026-56850",
    "lastModified": "2026-10-23T22:10:00.160",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 0.5,
          "impactScore": 3.6,
          "source": "support@hackerone.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 0.8,
          "impactScore": 3.6,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-56850",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-07-30T12:37:02.406813Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-07-30T06:25:55.073",
    "references": [
      {
        "source": "support@hackerone.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
      }
    ],
    "sourceIdentifier": "support@hackerone.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-287"
          }
        ],
        "source": "support@hackerone.com",
        "type": "Secondary"
      }
    ]
  },
  "severity": "MEDIUM",
  "source": "nvd",
  "title": "A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) ..."
}