OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0 Session Cache https.Agent.prototype.getName certificate validation

Summaryinfo

A vulnerability identified as problematic has been detected in OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0. Affected by this vulnerability is the function https.Agent.prototype.getName of the component Session Cache. The manipulation leads to certificate validation. This vulnerability is documented as CVE-2026-123877. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0. It has been rated as problematic. This issue affects the function https.Agent.prototype.getName of the component Session Cache. The manipulation with an unknown input leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is integrity. The summary by CVE is:

A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

The advisory is shared at nodejs.org. The identification of this vulnerability is CVE-2026-123877 since 11/06/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1587.003 for this issue.

Upgrading to version 22.23.5, 24.22.3 or 26.13.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• JavaScript Library

Vendor

• OpenJS Foundation

Name

• Node.js

Version

• 22.23.0
• 22.23.1
• 22.23.2
• 22.23.3
• 22.23.4
• 24.22.0
• 24.22.1
• 24.22.2
• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5
• 26.6
• 26.7
• 26.8
• 26.9
• 26.10
• 26.11
• 26.12
• 26.13.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion