WebSocket Transport Vulnerability in Eclipse Ditto Node.js Client

CVE-2026-84197

What is CVE-2026-84197?

In Eclipse Ditto's Node.js JavaScript client, a serious vulnerability exists due to the hard-coded 'rejectUnauthorized' option set to false for WebSocket connections. This design flaw disables certificate chain and hostname validation for all secure WebSocket (wss://) connections, exposing applications to potential man-in-the-middle (MitM) attacks. An attacker who can intercept WebSocket communications can exploit this vulnerability by presenting any arbitrary certificate, allowing them to complete the TLS handshake. Consequently, they gain access to sensitive information, including credentials sent in the Authorization header during the WebSocket upgrade request, and can manipulate or inject messages sent over the Ditto Protocol. As a result, users of affected versions should take immediate action to mitigate associated risks.

References