Medium severity4.4NVD Advisory· Published Jul 30, 2026· Updated Aug 25, 2026
CVE-2026-56850
CVE-2026-56850
Description
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
11- Range: 26.x, 24.x, 22.x
- osv-coords10 versionspkg:apk/chainguard/nodejs-22pkg:apk/chainguard/nodejs-24pkg:apk/wolfi/nodejs-22pkg:apk/wolfi/nodejs-24pkg:bitnami/nodepkg:bitnami/node-minpkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nodejs26&distro=openSUSE%20Tumbleweed
< 22.23.2-r0+ 9 more
- (no CPE)range: < 22.23.2-r0
- (no CPE)range: < 24.19.0-r0
- (no CPE)range: < 22.23.2-r0
- (no CPE)range: < 24.19.0-r0
- (no CPE)range: < 22.23.2
- (no CPE)range: < 22.23.2
- (no CPE)range: < 22.23.2-160000.1.1
- (no CPE)range: < 24.18.1-160000.1.1
- (no CPE)range: < 24.18.1-1.1
- (no CPE)range: < 26.5.1-1.1
Patches
Vulnerability mechanics
References
1- nodejs.org/en/blog/vulnerability/july-2026-security-releasesnvdVendor Advisory
News mentions
2- Node.js: Four Permission Model & HTTPS Agent Flaws Patched in July 2026 BatchVypr Intelligence · Jul 31, 2026
- Node.js Fixes 11 Security Flaws That Can Crash Servers and Break Filesystem RestrictionsCyber Security News · Jul 30, 2026