CVE-2026-123877: Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse
nodejs · node
No distribution fix yet for RHEL 8/9/10, Debian 12/13, SLES 15 SP7/16.0/16.1, openSUSE Leap 16.0/16.1 · Affected: nodejs · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 11% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- nodejs
- Published
- November 2026
Fix status by distribution
From each distribution’s security tracker. Distributions we did not check are not listed.
- Red Hat Enterprise Linux 10Affected, no fix releasedchecked 15 Nov 09:30 UTC
- Red Hat Enterprise Linux 9Affected, no fix releasedchecked 15 Nov 09:30 UTC
- Red Hat Enterprise Linux 8Affected, no fix releasedchecked 15 Nov 09:30 UTC
- Ubuntu 26.04Under investigationchecked 15 Nov 09:30 UTC
- Ubuntu 24.04Under investigationchecked 15 Nov 09:30 UTC
- Ubuntu 22.04Under investigationchecked 15 Nov 09:30 UTC
- Debian 13Affected, no fix releasedchecked 15 Nov 09:30 UTC
- Debian 12Affected, no fix releasedchecked 15 Nov 09:30 UTC
- SUSE Linux Enterprise Server 16.1Affected, no fix releasedchecked 15 Nov 09:30 UTC
- SUSE Linux Enterprise Server 16.0Affected, no fix releasedchecked 15 Nov 09:30 UTC
- SUSE Linux Enterprise Server 15 SP7Affected, no fix releasedchecked 15 Nov 09:30 UTC
- openSUSE Leap 16.1Affected, no fix releasedchecked 15 Nov 09:30 UTC
- openSUSE Leap 16.0Affected, no fix releasedchecked 15 Nov 09:30 UTC
What changed
Debian status tracked since 14 Nov 2026. Red Hat status tracked since 14 Nov 2026. SUSE status tracked since 15 Nov 2026. Ubuntu status tracked since 14 Nov 2026.
- SUSE’s tracker lists openSUSE Leap 16.0 as affected, with no fix released SUSE
- SUSE’s tracker lists openSUSE Leap 16.1 as affected, with no fix released SUSE
- SUSE’s tracker lists SLES 15 SP6 as affected, with no fix released SUSE
- SUSE’s tracker lists SLES 15 SP7 as affected, with no fix released SUSE
- SUSE’s tracker lists SLES 16.0 as affected, with no fix released SUSE
- SUSE’s tracker lists SLES 16.1 as affected, with no fix released SUSE
- Debian’s tracker lists Debian 12 as affected, with no fix released Debian
- Debian’s tracker lists Debian 13 as affected, with no fix released Debian
- Red Hat’s tracker lists RHEL 10 as affected, with no fix released Red Hat
- Red Hat’s tracker lists RHEL 8 as affected, with no fix released Red Hat
- Red Hat’s tracker lists RHEL 9 as affected, with no fix released Red Hat
- Ubuntu’s tracker lists Ubuntu 14.04 as under investigation Ubuntu
- Ubuntu’s tracker lists Ubuntu 16.04 as under investigation Ubuntu
- Ubuntu’s tracker lists Ubuntu 18.04 as under investigation Ubuntu
- Ubuntu’s tracker lists Ubuntu 20.04 as under investigation Ubuntu
- Ubuntu’s tracker lists Ubuntu 22.04 as under investigation Ubuntu
- Ubuntu’s tracker lists Ubuntu 24.04 as under investigation Ubuntu
- Ubuntu’s tracker lists Ubuntu 26.04 as under investigation Ubuntu
- Ubuntu’s tracker lists Ubuntu stonking as under investigation Ubuntu
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 11 Nov.
- Node.js fixes HTTP/2 and TLS flaws exposing data and keysSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.