CVSS 3.0
6.8 mediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NCVE-2026-123877 Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse
Medium (6.8) in nodejs node. EPSS 0.2% estimated probability of exploitation activity in the next 30 days.
On this page
A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
- EPSS
- 0.2% estimated probability of exploitation activity in the next 30 days; 12th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
- CWE
- CWE-295 Improper Certificate Validation
- OWASP Top 10
- A07:2025 Authentication Failures
- Published
- Modified
- Assigned by
- openjs (CNA)
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-123877 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-123877?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-123877?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-123877 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-123877)
HTML:
<a href="https://cve.bz/cve/CVE-2026-123877"><img src="https://cve.bz/cve/badge/CVE-2026-123877.svg" alt="CVE-2026-123877"></a>
Affected
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| nodejs node | from 0.0.0 before 22.23.5 |
| nodejs node | from 23.0.0 before 24.22.3 |
| nodejs node | from 25.0.0 before 26.13.1 |
Fix and patched versions
- Red Hat, Alpine, Alpaquita, BellSoft Hardened Containers: fixed package versions per release
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Debian | 12, 13, 14 | nodejs | no fix listed | DEBIAN-CVE-2026-123877 |
| Ubuntu | 24.04:LTS, 26.04:LTS, 26.10 and 5 more | nodejs | no fix listed | UBUNTU-CVE-2026-123877 |
| Red Hat | hummingbird:1 | nodejs22, nodejs22-bin, nodejs22-docs and 4 more | 1:22.23.5-2.3.2.3.1.hum1 | RHSA-2026:99433 |
| Red Hat | hummingbird:1 | nodejs22-npm | 1:10.9.9-1.22.23.5.2.3.2.3.1.hum1 | RHSA-2026:99433 |
| Red Hat | hummingbird:1 | nodejs24, nodejs24-bin, nodejs24-docs and 3 more | 1:24.22.3-0.1.hum1 | RHSA-2026:99435 |
| Red Hat | hummingbird:1 | nodejs24-npm | 2:11.19.1-1.24.22.3.0.1.hum1 | RHSA-2026:99435 |
| Red Hat | hummingbird:1 | nodejs24-npm-bin | 2:24.22.3-0.1.hum1 | RHSA-2026:99435 |
| Red Hat | hummingbird:1 | nodejs26, nodejs26-bin, nodejs26-docs and 4 more | 1:26.13.1-0.1.hum1 | RHSA-2026:99436 |
| Red Hat | hummingbird:1 | nodejs26-npm | 1:11.20.0-1.26.13.1.0.1.hum1 | RHSA-2026:99436 |
| Alpine | v3.21, v3.22 | nodejs | 22.23.5-r0 | ALPINE-CVE-2026-123877 |
| Alpine | v3.23, v3.24 | nodejs | 24.22.3-r0 | ALPINE-CVE-2026-123877 |
| Alpine | v3.24 | nodejs-current | 26.13.1-r0 | ALPINE-CVE-2026-123877 |
| Alpaquita | stream | nodejs22 | 22.23.5-r0 | BELL-CVE-2026-123877 |
| Alpaquita | stream | nodejs24 | 24.22.3-r0 | BELL-CVE-2026-123877 |
| Alpaquita | stream | nodejs26 | 26.13.1-r0 | BELL-CVE-2026-123877 |
| BellSoft Hardened Containers | stream | nodejs22 | 22.23.5-r0 | BELL-CVE-2026-123877 |
| BellSoft Hardened Containers | stream | nodejs24 | 24.22.3-r0 | BELL-CVE-2026-123877 |
| BellSoft Hardened Containers | stream | nodejs26 | 26.13.1-r0 | BELL-CVE-2026-123877 |
From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0; Red Hat Security Data © Red Hat, Inc., CC BY 4.0; the Alpine secdb, CC BY-SA 4.0; BellSoft's OSV database, MIT. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu · Red Hat · Alpine · Alpaquita · BellSoft Hardened Containers.
Red Hat
Red Hat rates this Moderate.
This vulnerability is rated as Moderate severity because exploitation depends on specific application patterns that share an HTTPS agent between requests using standard system trust stores and requests requiring custom certificate authority constraints. In typical Red Hat enterprise environments, applications usually maintain uniform TLS configurations or employ separate agent instances for sensitive outbound connections with distinct validation requirements. Because successful exploitation necessitates this uncommon agent-sharing pattern alongside precise connection sequencing and network positioning, the overall risk to most deployments remains contained.
Do not reuse a single https.Agent across requests that use different ca trust policies. Create separate Agents per CA policy, or disable TLS session reuse between divergent policies.
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | nodejs22 | Fix deferred | |
| Red Hat Enterprise Linux 10 | nodejs24 | Fix deferred | |
| Red Hat Enterprise Linux 10 | nodejs26 | Fix deferred | |
| Red Hat Enterprise Linux 8 | nodejs:22/nodejs | Fix deferred | |
| Red Hat Enterprise Linux 8 | nodejs:24/nodejs | Fix deferred | |
| Red Hat Enterprise Linux 9 | nodejs:22/nodejs | Fix deferred | |
| Red Hat Enterprise Linux 9 | nodejs:24/nodejs | Fix deferred | |
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | Fix deferred | |
| Red Hat Hardened Images | hi/nodejs | Under investigation | |
| Red Hat Hardened Images | nodejs20 | Will not fix | |
| Red Hat Hardened Images | nodejs22 | Affected | |
| Red Hat Hardened Images | nodejs24 | Affected | |
| Red Hat Hardened Images | nodejs25 | Will not fix | |
| Red Hat Hardened Images | nodejs26 | Affected | |
| Red Hat Hardened Images | npm12 | Under investigation |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-123877.
Attack patterns (CAPEC)
- CAPEC-459 Creating a Rogue Certification Authority Certificate Likelihood: Medium · Severity: Very High
- CAPEC-475 Signature Spoofing by Improper Validation Likelihood: Low · Severity: High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.