CVE-2026-123867 · Runtime
NO FIX YET
Node.js TLS servers that set a per-hostname client certificate CA without a server certificate for that name fall back to the default client CA. A client trusted only by the default CA can complete mutual TLS to the protected hostname and read its responses.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only servers that use server.addContext(host, { ca }) for per-host mutual TLS, where the SNI context has no server certificate, are exposed. Servers that use one default client CA, or that give every SNI context its own server certificate, are not described by the sources as affected. The sources do not state a fixed version.
Not affected if default-config, single-client-ca
Who cares mtls, node.js, self-hosted, tls
addContext( calls that pass an ca option and no cert or key for the same host.node --version; affected lines are 26.x, 24.x and 22.x.A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context's CA only when setSniContext succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
This page as .md · .json · CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
No fix yet, per the sources.