Client Certificate Authentication Bypass in Node.js by OpenJS Foundation

CVE-2026-123872

What is CVE-2026-123872?

A significant vulnerability exists in Node.js's TLS handling that allows a client to exploit certificate authentication processes. During TLS 1.2 renegotiation, a malicious client can alter the server name, enabling them to authenticate on a host where stricter client-certificate policies are enforced. This allows unauthorized access to protected endpoints, effectively bypassing established security measures meant to safeguard sensitive data. The issue is particularly critical for servers applying different client-certificate policies based on hostname, underlining the importance of vigilant security practices when handling client-authenticated connections.

References