CVE-2026-56850

MediumCVSS 4.4/10Last modified Oct 23, 2026

Description

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
nodejs	node	>= 26.5.0, <= 26.5.0; >= 24.18.0, <= 24.18.0; >= 22.23.1, <= 22.23.1

References

https://nodejs.org/en/blog/vulnerability/july-2026-security-releasesVendor Advisory

Timeline

Published: Jul 30, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-568517.5The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.CVE-2026-568527.5A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.CVE-2026-568537.5When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 c CVE-2026-568547.5The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and CVE-2026-568557.5Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. No CVE-2026-568579.8On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory CVE-2026-568586.1Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potenti CVE-2026-568597.5Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.CVE-2026-56868.8A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/CVE-2026-568605.9Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each st CVE-2026-568627.5Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not CVE-2026-568647.5A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coor