Node.js: Client certificate authentication bypass via TLS 1.2 renegotiation
Summary
A flaw in the Node.js TLS module allows a client to change the servername during a TLS 1.2 renegotiation and reach hosts it is not authorized for. It affects servers that apply different client-certificate policies per hostname, such as an admin-only host and an ordinary host on the same Node.js server. An attacker who already holds a client certificate accepted by a permitted host can carry that authentication to the protected host and bypass the stricter policy, gaining confidentiality and integrity impact there. The CVSS score is 8.1 (high).
Affected
- Node.js 22.x before 22.23.5
- Node.js 24.x before 24.22.3
- Node.js 26.x before 26.13.1
- The earliest affected version of each line is unknown. The CNA record also lists 23.x and 25.x ranges, which are not vendor release lines; verify against the vendor advisory.
Fixed in
- Node.js 22.23.5
- Node.js 24.22.3
- Node.js 26.13.1
Workaround
- No vendor workaround published. Patching is the fix.
- Interim suggestion (not from the vendor): review Node.js TLS servers that apply different client-certificate rules per hostname and enforce the stricter check inside the application for admin routes.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- Not checked directly against the CISA KEV catalog.
- The fix was pre-announced; public diffs may enable reverse engineering.
Our recommendation
- Update Node.js hosts on 22.x, 24.x or 26.x to the fixed versions listed above.
- Rebuild container images and single-executable applications, not only the host installation.
- Retire any end-of-life Node.js lines, which will not receive fixes.
- Review client-certificate configuration on Node.js TLS servers that serve multiple hostnames with different policies.
- Prioritise this if such a configuration exists; otherwise, patch in the regular cycle.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenJS CNA Security Advisories cna.openjsf.org
- Node.js Security Releases, 11 November 2026 nodejs.org
- Node.js v24.22.3 release nodejs.org
- Node.js v26.13.1 release nodejs.org
- CVE-2026-123872 record mirror cve.threatint.com
- OffSeq threat radar entry for CVE-2026-123872 radar.offseq.com
- SecurityOnline: Node.js HTTP/2 and TLS vulnerabilities, November 2026 securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:27.
Original description (NVD)
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.