cve.bz

CVE-2026-123872 Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change

8.1 highEPSS 0.4%

High (8.1) in nodejs node. EPSS 0.4% estimated probability of exploitation activity in the next 30 days.

On this page
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Severity

CVSS 3.0

8.1 high
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
0.4% estimated probability of exploitation activity in the next 30 days; 30th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
CWE
CWE-287 Improper Authentication
OWASP Top 10
A07:2025 Authentication Failures
Published
Modified
Assigned by
openjs (CNA)
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-123872 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-123872?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-123872?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-123872 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

CVE-2026-123872

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-123872](https://cve.bz/cve/badge/CVE-2026-123872.svg)](https://cve.bz/cve/CVE-2026-123872)

HTML:

<a href="https://cve.bz/cve/CVE-2026-123872"><img src="https://cve.bz/cve/badge/CVE-2026-123872.svg" alt="CVE-2026-123872"></a>

Affected

Versions

From the CNA's record in the CVE List.

ProductAffected
nodejs nodefrom 0.0.0 before 22.23.5
nodejs nodefrom 23.0.0 before 24.22.3
nodejs nodefrom 25.0.0 before 26.13.1

Fix and patched versions

Linux distributions

DistributionReleasePackageFixed inAdvisory
Debian12, 13, 14nodejsno fix listedDEBIAN-CVE-2026-123872
Ubuntu24.04:LTS, 26.04:LTS, 26.10 and 5 morenodejsno fix listedUBUNTU-CVE-2026-123872
Red Hathummingbird:1nodejs22, nodejs22-bin, nodejs22-docs and 4 more1:22.23.5-2.3.2.3.1.hum1RHSA-2026:99433
Red Hathummingbird:1nodejs22-npm1:10.9.9-1.22.23.5.2.3.2.3.1.hum1RHSA-2026:99433
Red Hathummingbird:1nodejs24, nodejs24-bin, nodejs24-docs and 3 more1:24.22.3-0.1.hum1RHSA-2026:99435
Red Hathummingbird:1nodejs24-npm2:11.19.1-1.24.22.3.0.1.hum1RHSA-2026:99435
Red Hathummingbird:1nodejs24-npm-bin2:24.22.3-0.1.hum1RHSA-2026:99435
Red Hathummingbird:1nodejs26, nodejs26-bin, nodejs26-docs and 4 more1:26.13.1-0.1.hum1RHSA-2026:99436
Red Hathummingbird:1nodejs26-npm1:11.20.0-1.26.13.1.0.1.hum1RHSA-2026:99436
Alpinev3.21, v3.22nodejs22.23.5-r0ALPINE-CVE-2026-123872
Alpinev3.23, v3.24nodejs24.22.3-r0ALPINE-CVE-2026-123872
Alpinev3.24nodejs-current26.13.1-r0ALPINE-CVE-2026-123872
Alpaquitastreamnodejs2222.23.5-r0BELL-CVE-2026-123872
Alpaquitastreamnodejs2424.22.3-r0BELL-CVE-2026-123872
Alpaquitastreamnodejs2626.13.1-r0BELL-CVE-2026-123872
BellSoft Hardened Containersstreamnodejs2222.23.5-r0BELL-CVE-2026-123872
BellSoft Hardened Containersstreamnodejs2424.22.3-r0BELL-CVE-2026-123872
BellSoft Hardened Containersstreamnodejs2626.13.1-r0BELL-CVE-2026-123872

From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0; Red Hat Security Data © Red Hat, Inc., CC BY 4.0; the Alpine secdb, CC BY-SA 4.0; BellSoft's OSV database, MIT. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu · Red Hat · Alpine · Alpaquita · BellSoft Hardened Containers.

Red Hat

Red Hat rates this Important.

Red Hat's statement

This vulnerability is rated as an Important severity flaw because an authenticated attacker can circumvent host-level access controls and reach privileged virtual host endpoints over an existing connection. Exploitation requires non-default architectures where a Node.js process directly handles TLS termination across multi-tenant domains with heterogeneous mutual TLS policies using TLS 1.2. Deployments where TLS is terminated by front-end reverse proxies, ingress routers, or environments utilizing TLS 1.3 exclusively are not exposed to this renegotiation issue.

Red Hat's mitigation

Enforce TLS 1.3 to eliminate renegotiation, or terminate TLS at a proxy that does not forward TLS 1.2 renegotiation. Avoid differing per-SNI mTLS policies on one listener when TLS 1.2 remains enabled.

ProductPackageStateAdvisory
Red Hat Enterprise Linux 10nodejs22Affected
Red Hat Enterprise Linux 10nodejs24Affected
Red Hat Enterprise Linux 10nodejs26Affected
Red Hat Enterprise Linux 8nodejs:22/nodejsAffected
Red Hat Enterprise Linux 8nodejs:24/nodejsAffected
Red Hat Enterprise Linux 9nodejs:22/nodejsAffected
Red Hat Enterprise Linux 9nodejs:24/nodejsAffected
Red Hat Enterprise Linux 9nodejs:26/nodejsAffected
Red Hat Hardened Imageshi/nodejsUnder investigation
Red Hat Hardened Imagesnodejs20Will not fix
Red Hat Hardened Imagesnodejs22Affected
Red Hat Hardened Imagesnodejs24Affected
Red Hat Hardened Imagesnodejs25Will not fix
Red Hat Hardened Imagesnodejs26Affected
Red Hat Hardened Imagesnpm12Under investigation

Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-123872.

Attack patterns (CAPEC)

  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Likelihood: Medium · Severity: Very High
  • CAPEC-94 Adversary in the Middle (AiTM) Likelihood: High · Severity: Very High
  • CAPEC-114 Authentication Abuse Severity: Medium
  • CAPEC-115 Authentication Bypass Severity: Medium
  • CAPEC-151 Identity Spoofing Likelihood: Medium · Severity: Medium
  • CAPEC-194 Fake the Source of Data Severity: Medium
  • CAPEC-593 Session Hijacking Likelihood: High · Severity: Very High
  • CAPEC-633 Token Impersonation Severity: Medium
  • CAPEC-650 Upload a Web Shell to a Web Server Severity: High

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.

References

Check your stackJSON