CVE-2026-123872: Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not establishedNothing in the sources we check

DescriptionNVD

A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Improper Authentication · Authentication

Vendor

nodejs

Published

November 2026

Band

Unlikely (under 1%), November 2026

• Red Hat Enterprise Linux 10Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Red Hat Enterprise Linux 9Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Red Hat Enterprise Linux 8Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Ubuntu 26.04Under investigationchecked 15 Nov 09:30 UTC
• Ubuntu 24.04Under investigationchecked 15 Nov 09:30 UTC
• Ubuntu 22.04Under investigationchecked 15 Nov 09:30 UTC
• Debian 13Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Debian 12Affected, no fix releasedchecked 15 Nov 09:30 UTC
• SUSE Linux Enterprise Server 16.1Affected, no fix releasedchecked 15 Nov 09:30 UTC
• SUSE Linux Enterprise Server 16.0Affected, no fix releasedchecked 15 Nov 09:30 UTC
• SUSE Linux Enterprise Server 15 SP7Affected, no fix releasedchecked 15 Nov 09:30 UTC
• openSUSE Leap 16.1Affected, no fix releasedchecked 15 Nov 09:30 UTC
• openSUSE Leap 16.0Affected, no fix releasedchecked 15 Nov 09:30 UTC

1. 15 Nov
   SUSE’s tracker lists openSUSE Leap 16.0 as affected, with no fix released SUSE
2. 15 Nov
   SUSE’s tracker lists openSUSE Leap 16.1 as affected, with no fix released SUSE
3. 15 Nov
   SUSE’s tracker lists SLES 15 SP6 as affected, with no fix released SUSE
4. 15 Nov
   SUSE’s tracker lists SLES 15 SP7 as affected, with no fix released SUSE
5. 15 Nov
   SUSE’s tracker lists SLES 16.0 as affected, with no fix released SUSE
6. 15 Nov
   SUSE’s tracker lists SLES 16.1 as affected, with no fix released SUSE
7. 14 Nov
   Debian’s tracker lists Debian 12 as affected, with no fix released Debian
8. 14 Nov
   Debian’s tracker lists Debian 13 as affected, with no fix released Debian
9. 14 Nov
   Red Hat’s tracker lists RHEL 10 as affected, with no fix released Red Hat
10. 14 Nov
    Red Hat’s tracker lists RHEL 8 as affected, with no fix released Red Hat
11. 14 Nov
    Red Hat’s tracker lists RHEL 9 as affected, with no fix released Red Hat
12. 14 Nov
    Ubuntu’s tracker lists Ubuntu 14.04 as under investigation Ubuntu
13. 14 Nov
    Ubuntu’s tracker lists Ubuntu 16.04 as under investigation Ubuntu
14. 14 Nov
    Ubuntu’s tracker lists Ubuntu 18.04 as under investigation Ubuntu
15. 14 Nov
    Ubuntu’s tracker lists Ubuntu 20.04 as under investigation Ubuntu
16. 14 Nov
    Ubuntu’s tracker lists Ubuntu 22.04 as under investigation Ubuntu
17. 14 Nov
    Ubuntu’s tracker lists Ubuntu 24.04 as under investigation Ubuntu
18. 14 Nov
    Ubuntu’s tracker lists Ubuntu 26.04 as under investigation Ubuntu
19. 14 Nov
    Ubuntu’s tracker lists Ubuntu stonking as under investigation Ubuntu

• NVD entrynvd.nist.gov
• Vendor advisorynodejs.org
• CVE recordcve.org