Improper authorization control for web services In nodejs
Description
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | 20.19.2+dfsg-1+deb13u3 | ||
 rpm rhel9 | 1:22.23.2-1.module+el9.8.0+24709+804d6b5b | ||
rpm rhel9.6 | 1:22.23.2-1.module+el9.6.0+24769+299a7e3a | ||
rpm rhel10 | 1:24.19.0-1.el10_2 | ||
rpm rhel10.0 | 1:22.23.2-1.el10_0 | ||
rpm rhel10 | - | - | |
 alpine v3.22 | 22.23.2-r0 | ||
alpine v3.24 | 24.18.1-r0 | ||
alpine v3.21 | 22.23.2-r0 | ||
alpine v3.23 | 24.18.1-r0 |
1-10 of 15
10
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9.
References
1. 2.