{"id":"CVE-2026-123877","kind":"vulnerability","aliases":["CVE-2026-123877"],"related":[],"title":"Node.js: cached TLS sessions skip stricter certificate checks in https.Agent","description":"A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","summary":"Node.js https.Agent reuses a cached TLS session across requests that use different certificate authority policies, because the cache key ignores an empty ca array. A later request with a stricter CA policy can therefore send confidential data to a server it should have rejected.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["https","node.js","runtime","self-hosted","tls"],"not_affected_if":["default-config","single-ca-policy"],"how_to_check":"- Run `node --version` and compare against the fixed versions below.\n- Search your code for `https.Agent` or `ca: []` used alongside requests that rely on the default trust store.","fix":null,"status":"open","published_at":"2026-11-11T19:17:34+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","triaged_at":"2026-11-11T19:30:15+00:00","updated_at":"2026-11-11T19:30:15+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-11T19:30:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Node.js: cached TLS sessions skip stricter certificate checks in https.Agent","impact":"medium","summary":"Node.js https.Agent reuses a cached TLS session across requests that use different certificate authority policies, because the cache key ignores an empty ca array. A later request with a stricter CA policy can therefore send confidential data to a server it should have rejected.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["node.js","https","tls","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Confidential data sent to a server that fails certificate validation","analyst_note":"Find the fixed Node.js versions for 22.x, 24.x and 26.x in the Node.js security advisory tied to CVE-2026-123877; the NVD entry gave none.","how_to_check":"- Run `node --version` and compare against the fixed versions below.\n- Search your code for `https.Agent` or `ca: []` used alongside requests that rely on the default trust store.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","single-ca-policy"],"who_is_affected":"Applications running Node.js 22.x, 24.x or 26.x that make outbound HTTPS requests through https.Agent with different ca settings, where one request uses the default trust store and another passes an empty ca array. Services that only use a single default trust store or never pass ca: [] are likely not exposed. The sources do not name fixed versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4753,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123877':13A,16A '-2026':12A,15A '1.3':179C '22':220C '24':217C '26':215C 'across':31B 'affect':213C 'agent':99C 'append':121C 'array':47B,129C 'assign':96C 'authent':80C,159C,185C 'author':37B,192C 'broader':162C 'bypass':71C 'ca':46B,54B,83C,110C,116C,140C,148C,175C,203C 'cach':2A,28B,41B,77C,103C 'carri':182C 'certif':7A,36B,69C 'check':8A 'confidenti':59B,196C 'connect':170C,210C 'cve':11A,14A 'data':60B,197C 'default':143C,163C 'differ':35B,138C 'earlier':184C 'empti':45B,128C,133C 'explicit':114C 'forward':186C 'fresh':209C 'hand':166C 'host':22B 'https':17B 'https.agent':10A,25B,74C 'https.agent.prototype.getname':95C 'ignor':43B 'key':42B,104C,125C,155C 'later':49B,89C,174C 'let':75C 'made':171C 'new':169C 'node.js':1A,18B,24B,73C,214C 'noth':122C 'omit':109C,119C,139C 'one':82C,112C 'polici':38B,55B,84C,94C,137C,164C,176C,204C 'reject':67B,206C 'replac':149C 'report':191C 'request':32B,50B,90C,107C,190C 'resumpt':181C 'reus':26B,86C 'runtim':19B 'second':189C 'self':21B 'self-host':20B 'send':58B 'server':63B,200C 'session':4A,30B,79C,102C,158C,180C 'session-cach':101C 'share':153C 'sinc':151C 'skip':5A 'store':145C 'stricter':6A,53B,93C 'string':134C 'stringifi':130C 'suppli':115C,147C 'therefor':57B 'tls':3A,23B,29B,78C,157C,178C 'transmit':195C 'true':193C 'trust':144C 'two':136C 'use':34B,141C 'valid':70C 'valu':120C 'vulner':212C 'would':205C 'x':216C,218C,221C","nicknames":[],"mitigations":[],"who_affected":"Applications running Node.js 22.x, 24.x or 26.x that make outbound HTTPS requests through https.Agent with different ca settings, where one request uses the default trust store and another passes an empty ca array. Services that only use a single default trust store or never pass ca: [] are likely not exposed. The sources do not name fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["https","medium","nodejs","runtime","selfhosted","tls"],"campaign_type":null,"search_a":"'-123877':13A,16A '-2026':12A,15A 'cach':2A 'certif':7A 'check':8A 'cve':11A,14A 'https.agent':10A 'node.js':1A 'session':4A 'skip':5A 'stricter':6A 'tls':3A","search_b":"'across':31B 'array':47B 'author':37B 'ca':46B,54B 'cach':28B,41B 'certif':36B 'confidenti':59B 'data':60B 'differ':35B 'empti':45B 'host':22B 'https':17B 'https.agent':25B 'ignor':43B 'key':42B 'later':49B 'node.js':18B,24B 'polici':38B,55B 'reject':67B 'request':32B,50B 'reus':26B 'runtim':19B 'self':21B 'self-host':20B 'send':58B 'server':63B 'session':30B 'stricter':53B 'therefor':57B 'tls':23B,29B 'use':34B","search_c":"'1.3':179C '22':220C '24':217C '26':215C 'affect':213C 'agent':99C 'append':121C 'array':129C 'assign':96C 'authent':80C,159C,185C 'author':192C 'broader':162C 'bypass':71C 'ca':83C,110C,116C,140C,148C,175C,203C 'cach':77C,103C 'carri':182C 'certif':69C 'confidenti':196C 'connect':170C,210C 'data':197C 'default':143C,163C 'differ':138C 'earlier':184C 'empti':128C,133C 'explicit':114C 'forward':186C 'fresh':209C 'hand':166C 'https.agent':74C 'https.agent.prototype.getname':95C 'key':104C,125C,155C 'later':89C,174C 'let':75C 'made':171C 'new':169C 'node.js':73C,214C 'noth':122C 'omit':109C,119C,139C 'one':82C,112C 'polici':84C,94C,137C,164C,176C,204C 'reject':206C 'replac':149C 'report':191C 'request':90C,107C,190C 'resumpt':181C 'reus':86C 'second':189C 'server':200C 'session':79C,102C,158C,180C 'session-cach':101C 'share':153C 'sinc':151C 'store':145C 'stricter':93C 'string':134C 'stringifi':130C 'suppli':115C,147C 'tls':78C,157C,178C 'transmit':195C 'true':193C 'trust':144C 'two':136C 'use':141C 'valid':70C 'valu':120C 'vulner':212C 'would':205C 'x':216C,218C,221C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123877","severity":null,"published_at":"2026-11-11T19:17:34+00:00","modified_at":"2026-11-11T19:17:34+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","fetched_at":"2026-11-11T19:28:46+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}