OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0 TLS Authorization src/crypto/crypto_tls.cc CertCbDone authorization

Summaryinfo

A vulnerability has been found in OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0 and classified as critical. This affects the function CertCbDone of the file src/crypto/crypto_tls.cc of the component TLS Authorization. This manipulation causes authorization. The identification of this vulnerability is CVE-2026-123867. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in OpenJS Foundation Node.js up to 22.23.4/24.22.2/26.13.0. It has been declared as critical. Affected by this vulnerability is the function CertCbDone of the file src/crypto/crypto_tls.cc of the component TLS Authorization. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context's CA only when setSniContext succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

The advisory is shared at nodejs.org. This vulnerability is known as CVE-2026-123867 since 11/06/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available.

Upgrading to version 22.23.5, 24.22.3 or 26.13.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• JavaScript Library

Vendor

• OpenJS Foundation

Name

• Node.js

Version

• 22.23.0
• 22.23.1
• 22.23.2
• 22.23.3
• 22.23.4
• 24.22.0
• 24.22.1
• 24.22.2
• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5
• 26.6
• 26.7
• 26.8
• 26.9
• 26.10
• 26.11
• 26.12
• 26.13.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion