Loading vulnerability…
Node.js HTTPS Agent TLS Session Reuse Hostname Verification Bypass
CVE-2026-58040 is a hostname verification bypass in Node.js HTTPS Agent TLS session reuse, resulting from an incomplete fix for CVE-2026-48934. Reusing TLS sessions across different identity-policy contexts can skip hostname verification, allowing a connection to proceed without the expected server-identity check. The vulnerability affects Node.js 22.x, 24.x, and 26.x releases preceding the corresponding security fixes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass server hostname verification and expose confidential information through an improperly authenticated HTTPS connection. SUSE rates the vulnerability Moderate, with CVSS v3.1 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N). Integrity and availability impacts are not established.
If you can’t patch tonight, do this now.
Until patched, minimize HTTPS/TLS session reuse across distinct hostname or identity-policy contexts. Restrict outbound HTTPS connectivity to trusted destinations and use network segmentation and egress controls to reduce exposure to attacker-controlled network paths. No vendor-confirmed workaround is specified.
Patch, then assume compromise.
Upgrade to Node.js 22.23.2, 24.18.1, or 26.5.1, or a later fixed release in the corresponding branch. For distribution-managed installations, apply the vendor's patched packages; identified fixes include Debian 12 package version 18.20.4+dfsg-1~deb12u3 and Alpine nodejs-current 26.5.1-r0. Update bundled Node.js runtimes through the applicable product or buildpack security release.
No validated public exploits yet. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.