Loading vulnerability…
Node.js HTTPS Agent mTLS Identity Confusion
CVE-2026-56850 is a connection-reuse vulnerability in the Node.js HTTPS Agent affecting the 22.x, 24.x, and 26.x release lines. Collisions in connection-pool keys derived from PFX object arrays can cause requests configured with different client certificates to reuse an existing connection authenticated with another mTLS client identity. This breaks the intended separation between certificate configurations and can cause requests to execute under an unintended identity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Requests may be authenticated by a remote service as a different client than intended, potentially allowing unauthorized operations under the reused certificate identity. The demonstrated security impact is integrity loss through client-identity confusion or impersonation. Confidentiality loss, denial of service, and code execution are not established for this vulnerability.
If you can’t patch tonight, do this now.
Avoid sharing HTTPS Agent instances between requests using different mTLS client identities. Use separate agents for each client certificate or PFX configuration so that authenticated connections cannot be reused across identities. Restrict privileged local access and the ability to modify application TLS client-certificate settings until updates are deployed.
Patch, then assume compromise.
Upgrade Node.js to 22.23.2, 24.18.1, or 26.5.1, or a later fixed release in the applicable branch. For distribution-managed installations, install the vendor's security-fixed packages; identified fixes include Debian 12 version 18.20.4+dfsg-1~deb12u3, Debian 13 version 20.19.2+dfsg-1+deb13u3, and Alpine nodejs-current version 26.5.1-r0. Update bundled runtimes through the applicable product or buildpack security release.
No validated public exploits yet. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.