CVE-2026-58040

MediumCVSS 6.3/10Last modified Oct 23, 2026

Description

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

Metrics

CVSS 3.0 6.3/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-297

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
nodejsnode>= 22.23.1, <= 22.23.1; >= 24.18.0, <= 24.18.0; >= 26.5.0, <= 26.5.0

References

Timeline

Published
Jul 30, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-580415.3A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cacCVE-2026-580425.9A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated trCVE-2026-580438.4A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`CVE-2026-580443.7A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from CVE-2026-580456.2A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing tCVE-2026-580469.9Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitraCVE-2026-580475.6HTTP Smuggling in cPanel allows potential leak of credentials.CVE-2026-580489.4Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.CVE-2026-580498.6FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-bCVE-2026-58057.3A weakness has been identified in code-projects Easy Blog Site up to 1.0. The impacted element is an unknown function of the file /users/conCVE-2026-580507.5libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocationCVE-2026-580516.5libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so