Certificate Validation Bypass in Node.js Affects Multiple Versions

CVE-2026-123877

What is CVE-2026-123877?

A vulnerability in Node.js allowing a certificate validation bypass due to improper handling of cached TLS sessions. When using https.Agent, requests with a stricter Certificate Authority (CA) policy can reuse a session from a request with a broader policy. This occurs because both requests share the same agent and session-cache key, where the omission of a CA and the explicit supply of an empty CA array lead to the same cache key. Consequently, a TLS session authenticated under the less strict default policy can be incorrectly utilized by a connection that follows a stricter CA requirement, potentially exposing confidential data.

References