Mutual-TLS Authorization Bypass Flaw in Node.js

CVE-2026-123867

What is CVE-2026-123867?

A mutual-TLS authorization bypass vulnerability in Node.js allows clients to access protected hostnames without proper authorization. In scenarios where a hostname is assigned a different client-certificate CA via server.addContext, but lacks a corresponding server certificate, the handshake process defaults to the initial client CA. This means that a client authorized by the default CA can initiate an mTLS session to a secured hostname intended for clients authenticated by a distinct CA, thus compromising the integrity of the mutual-TLS implementation. Affected versions include Node.js 26.x, 24.x, and 22.x.

References