Authentication Bypass by Primary Weakness in Node.js - CVE-2026-56850
Published: July 29, 2026 / Updated: July 29, 2026
Vulnerability identifier: #VU140041
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-56850
CWE-ID: CWE-305
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
Node.js
Node.js
Detailed vulnerability description
The vulnerability allows a remote user to reuse mutual TLS client identities across requests configured with different client certificates.
The vulnerability exists due to improper connection reuse in the Node.js HTTPS Agent when reusing connections across requests configured with different PFX certificates. A remote user can cause PFX object-array key collisions to reuse mutual TLS client identities across requests configured with different client certificates.
How to mitigate CVE-2026-56850
Install security update from vendor's website.