CVE-2026-123867: Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not establishedNothing in the sources we check

DescriptionNVD

A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, { ca: protectedCA })` but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In `src/crypto/crypto_tls.cc`, `CertCbDone` installs the SNI context's CA only when `setSniContext` succeeds, but `setSniContext` returns `false` for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with `requestCert` and `rejectUnauthorized` enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Improper Certificate Validation · Cryptography

Vendor

nodejs

Published

November 2026

Band

Unlikely (under 1%), November 2026

• Red Hat Enterprise Linux 10Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Red Hat Enterprise Linux 9Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Red Hat Enterprise Linux 8Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Ubuntu 26.04Under investigationchecked 15 Nov 09:30 UTC
• Ubuntu 24.04Under investigationchecked 15 Nov 09:30 UTC
• Ubuntu 22.04Under investigationchecked 15 Nov 09:30 UTC
• Debian 13Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Debian 12Affected, no fix releasedchecked 15 Nov 09:30 UTC
• SUSE Linux Enterprise Server 16.1Affected, no fix releasedchecked 15 Nov 09:30 UTC
• SUSE Linux Enterprise Server 16.0Affected, no fix releasedchecked 15 Nov 09:30 UTC
• SUSE Linux Enterprise Server 15 SP7Affected, no fix releasedchecked 15 Nov 09:30 UTC
• openSUSE Leap 16.1Affected, no fix releasedchecked 15 Nov 09:30 UTC
• openSUSE Leap 16.0Affected, no fix releasedchecked 15 Nov 09:30 UTC

1. 15 Nov
   SUSE’s tracker lists openSUSE Leap 16.0 as affected, with no fix released SUSE
2. 15 Nov
   SUSE’s tracker lists openSUSE Leap 16.1 as affected, with no fix released SUSE
3. 15 Nov
   SUSE’s tracker lists SLES 15 SP6 as affected, with no fix released SUSE
4. 15 Nov
   SUSE’s tracker lists SLES 15 SP7 as affected, with no fix released SUSE
5. 15 Nov
   SUSE’s tracker lists SLES 16.0 as affected, with no fix released SUSE
6. 15 Nov
   SUSE’s tracker lists SLES 16.1 as affected, with no fix released SUSE
7. 14 Nov
   Debian’s tracker lists Debian 12 as affected, with no fix released Debian
8. 14 Nov
   Debian’s tracker lists Debian 13 as affected, with no fix released Debian
9. 14 Nov
   Red Hat’s tracker lists RHEL 10 as affected, with no fix released Red Hat
10. 14 Nov
    Red Hat’s tracker lists RHEL 8 as affected, with no fix released Red Hat
11. 14 Nov
    Red Hat’s tracker lists RHEL 9 as affected, with no fix released Red Hat
12. 14 Nov
    Ubuntu’s tracker lists Ubuntu 14.04 as under investigation Ubuntu
13. 14 Nov
    Ubuntu’s tracker lists Ubuntu 16.04 as under investigation Ubuntu
14. 14 Nov
    Ubuntu’s tracker lists Ubuntu 18.04 as under investigation Ubuntu
15. 14 Nov
    Ubuntu’s tracker lists Ubuntu 20.04 as under investigation Ubuntu
16. 14 Nov
    Ubuntu’s tracker lists Ubuntu 22.04 as under investigation Ubuntu
17. 14 Nov
    Ubuntu’s tracker lists Ubuntu 24.04 as under investigation Ubuntu
18. 14 Nov
    Ubuntu’s tracker lists Ubuntu 26.04 as under investigation Ubuntu
19. 14 Nov
    Ubuntu’s tracker lists Ubuntu stonking as under investigation Ubuntu

• NVD entrynvd.nist.gov
• Vendor advisorynodejs.org
• CVE recordcve.org