CVE-2026-56850
- Source
- https://cve.org/CVERecord?id=CVE-2026-56850
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-56850.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-56850
- Aliases
- Downstream
ALPINE (1)
AZL (1)
BELL (1)
CGA (8)
CLEANSTART (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (8)
openSUSE (4)
SUSE (12)
UBUNTU (1)
- Related
- Published
- 2026-07-30T06:02:50Z
- Modified
- 2026-09-29T09:26:37Z
- Severity
-
- 4.1 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Database specific
{ "cna_assigner": "hackerone", "cwe_ids": [ "CWE-287" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56850.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "26.5.0" }, { "last_affected": "26.5.0" }, { "introduced": "24.18.0" }, { "last_affected": "24.18.0" }, { "introduced": "22.23.1" }, { "last_affected": "22.23.1" } ], "source": "AFFECTED_FIELD" } ] }- References
Affected packages
Git / github.com/nodejs/node
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nodejs/node
- Events
-
IntroducedLast AffectedIntroducedLast AffectedIntroducedLast Affected
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "extracted_events": [ { "introduced": "22.0" }, { "last_affected": "22.23.1" }, { "introduced": "24.0.0" }, { "last_affected": "24.18.0" }, { "introduced": "26.0.0" }, { "last_affected": "26.5.0" } ], "source": "CPE_RANGE" }
Affected versions
v22.*
v22.0.0
v22.1.0
v22.10.0
v22.11.0
v22.12.0
v22.13.0
v22.13.1
v22.14.0
v22.15.0
v22.15.1
v22.16.0
v22.17.0
v22.17.1
v22.18.0
v22.19.0
v22.2.0
v22.20.0
v22.21.0
v22.21.1
v22.22.0
v22.22.1
v22.22.2
v22.22.3
v22.23.0
v22.23.1
v22.3.0
v22.4.0
v22.4.1
v22.5.0
v22.5.1
v22.6.0
v22.7.0
v22.8.0
v22.9.0
v24.*
v24.0.0
v24.0.1
v24.0.2
v24.1.0
v24.10.0
v24.11.0
v24.11.1
v24.12.0
v24.13.0
v24.13.1
v24.14.0
v24.14.1
v24.15.0
v24.16.0
v24.17.0
v24.18.0
v24.2.0
v24.3.0
v24.4.0
v24.4.1
v24.5.0
v24.6.0
v24.7.0
v24.8.0
v24.9.0
v26.*
v26.0.0
v26.1.0
v26.2.0
v26.3.0
v26.3.1
v26.4.0
v26.5.0