OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0 TLS improper authorization

Summaryinfo

A vulnerability marked as critical has been reported in OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0. This affects an unknown part of the component TLS. This manipulation causes improper authorization. This vulnerability appears as CVE-2026-123872. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0. Affected by this vulnerability is an unknown code of the component TLS. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

It is possible to read the advisory at nodejs.org. This vulnerability is known as CVE-2026-123872 since 11/06/2026. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 22.23.5, 24.22.3 or 26.13.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• JavaScript Library

Vendor

• OpenJS Foundation

Name

• Node.js

Version

• 22.23.0
• 22.23.1
• 22.23.2
• 22.23.3
• 22.23.4
• 24.22.0
• 24.22.1
• 24.22.2
• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5
• 26.6
• 26.7
• 26.8
• 26.9
• 26.10
• 26.11
• 26.12
• 26.13.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion