{"id":"CVE-2026-123867","kind":"vulnerability","aliases":["CVE-2026-123867"],"related":[],"title":"Node.js: per-host mutual-TLS client CA silently falls back to default","description":"A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context's CA only when setSniContext succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","summary":"Node.js TLS servers that set a per-hostname client certificate CA without a server certificate for that name fall back to the default client CA. A client trusted only by the default CA can complete mutual TLS to the protected hostname and read its responses.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mtls","node.js","runtime","self-hosted","tls"],"not_affected_if":["default-config","single-client-ca"],"how_to_check":"- Search the codebase for `addContext(` calls that pass an `ca` option and no `cert` or `key` for the same host.\n- Check the Node.js version with `node --version`; affected lines are `26.x`, `24.x` and `22.x`.","fix":null,"status":"open","published_at":"2026-11-11T19:17:33+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","triaged_at":"2026-11-11T19:30:40+00:00","updated_at":"2026-11-11T19:30:40+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-11T19:30:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Node.js: per-host mutual-TLS client CA silently falls back to default","impact":"medium","summary":"Node.js TLS servers that set a per-hostname client certificate CA without a server certificate for that name fall back to the default client CA. A client trusted only by the default CA can complete mutual TLS to the protected hostname and read its responses.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["node.js","tls","mtls","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Client certificate check bypassed; protected hostname responses readable by unauthorized client","analyst_note":"Find the fixed Node.js versions for 22.x, 24.x and 26.x in the Node.js security release notes; the sources give none.","how_to_check":"- Search the codebase for `addContext(` calls that pass an `ca` option and no `cert` or `key` for the same host.\n- Check the Node.js version with `node --version`; affected lines are `26.x`, `24.x` and `22.x`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","single-client-ca"],"who_is_affected":"Only servers that use `server.addContext(host, { ca })` for per-host mutual TLS, where the SNI context has no server certificate, are exposed. Servers that use one default client CA, or that give every SNI context its own server certificate, are not described by the sources as affected. The sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000761,"input_tokens":4781,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123867':17A,20A '-2026':16A,19A '22':235C '24':232C '26':230C 'affect':228C 'assign':106C 'author':81C,88C,100C 'back':12A,48B,141C 'bypass':82C 'ca':9A,39B,53B,61B,114C,118C,133C,146C,155C,174C,182C,192C,197C,223C 'ca-on':173C 'certcbdon':149C 'certif':38B,43B,113C,123C,170C,187C 'certifi':219C 'client':8A,37B,52B,55B,87C,112C,132C,145C,184C,218C 'client-certif':111C 'complet':63B,200C 'context':127C,153C,166C,177C 'cve':15A,18A 'default':14A,51B,60B,91C,144C,181C,191C 'differ':110C 'enabl':215C 'even':210C 'fall':11A,47B,140C 'fals':163C 'handshak':139C 'hold':185C 'host':4A,26B,77C,117C,131C 'hostnam':36B,69B,92C,96C,108C,205C 'instal':136C,150C 'keep':179C 'let':85C 'mtls':21B,201C 'mutual':6A,64B,79C 'mutual-tl':5A,78C 'name':46B 'never':135C 'node.js':1A,22B,28B,84C,229C 'per':3A,35B,76C,130C 'per-host':2A,75C,129C 'per-hostnam':34B 'protect':68B,95C,196C,204C,222C 'protectedca':119C 'reach':93C 'read':71B,207C 'reject':225C 'rejectunauthor':214C 'requestcert':212C 'respons':73B,209C 'return':162C 'runtim':23B 'self':25B 'self-host':24B 'server':30B,42B,105C,122C,169C 'server.addcontext':116C 'set':32B 'setsnicontext':158C,161C 'silent':10A,178C 'sni':126C,152C,176C 'src/crypto/crypto_tls.cc':148C 'succeed':159C 'therefor':199C 'tls':7A,27B,29B,65B,80C,104C 'trust':56B,188C 'vulner':227C 'without':40B 'x':231C,233C,236C","nicknames":[],"mitigations":[],"who_affected":"Only servers that use `server.addContext(host, { ca })` for per-host mutual TLS, where the SNI context has no server certificate, are exposed. Servers that use one default client CA, or that give every SNI context its own server certificate, are not described by the sources as affected. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mtls","nodejs","runtime","selfhosted","tls"],"campaign_type":null,"search_a":"'-123867':17A,20A '-2026':16A,19A 'back':12A 'ca':9A 'client':8A 'cve':15A,18A 'default':14A 'fall':11A 'host':4A 'mutual':6A 'mutual-tl':5A 'node.js':1A 'per':3A 'per-host':2A 'silent':10A 'tls':7A","search_b":"'back':48B 'ca':39B,53B,61B 'certif':38B,43B 'client':37B,52B,55B 'complet':63B 'default':51B,60B 'fall':47B 'host':26B 'hostnam':36B,69B 'mtls':21B 'mutual':64B 'name':46B 'node.js':22B,28B 'per':35B 'per-hostnam':34B 'protect':68B 'read':71B 'respons':73B 'runtim':23B 'self':25B 'self-host':24B 'server':30B,42B 'set':32B 'tls':27B,29B,65B 'trust':56B 'without':40B","search_c":"'22':235C '24':232C '26':230C 'affect':228C 'assign':106C 'author':81C,88C,100C 'back':141C 'bypass':82C 'ca':114C,118C,133C,146C,155C,174C,182C,192C,197C,223C 'ca-on':173C 'certcbdon':149C 'certif':113C,123C,170C,187C 'certifi':219C 'client':87C,112C,132C,145C,184C,218C 'client-certif':111C 'complet':200C 'context':127C,153C,166C,177C 'default':91C,144C,181C,191C 'differ':110C 'enabl':215C 'even':210C 'fall':140C 'fals':163C 'handshak':139C 'hold':185C 'host':77C,117C,131C 'hostnam':92C,96C,108C,205C 'instal':136C,150C 'keep':179C 'let':85C 'mtls':201C 'mutual':79C 'mutual-tl':78C 'never':135C 'node.js':84C,229C 'per':76C,130C 'per-host':75C,129C 'protect':95C,196C,204C,222C 'protectedca':119C 'reach':93C 'read':207C 'reject':225C 'rejectunauthor':214C 'requestcert':212C 'respons':209C 'return':162C 'server':105C,122C,169C 'server.addcontext':116C 'setsnicontext':158C,161C 'silent':178C 'sni':126C,152C,176C 'src/crypto/crypto_tls.cc':148C 'succeed':159C 'therefor':199C 'tls':80C,104C 'trust':188C 'vulner':227C 'x':231C,233C,236C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123867","severity":null,"published_at":"2026-11-11T19:17:33+00:00","modified_at":"2026-11-11T19:17:33+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","fetched_at":"2026-11-11T19:28:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}