CVE-2026-56850: Node.js Auth Bypass Vulnerability

CVE-2026-56850 Overview

CVE-2026-56850 is an authentication weakness [CWE-287] in Node.js runtime. The flaw resides in the HTTPS Agent connection reuse logic. When applications supply mutual TLS (mTLS) client certificates as PFX object arrays, the Agent generates colliding cache keys. Node.js then reuses an existing TLS socket associated with a different client identity. As a result, an outbound HTTPS request configured with one client certificate may be transmitted over a connection authenticated with another. The issue affects Node.js 26.x, 24.x, and 22.x release lines.

Critical Impact
Applications using multiple PFX client certificates through a shared HTTPS Agent can leak or misuse mTLS identities, allowing requests to reach backends under the wrong authenticated principal.

Affected Products

Node.js 26.x
Node.js 24.x
Node.js 22.x

Discovery Timeline

2026-07-30 - CVE-2026-56850 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in the NVD database

Technical Details for CVE-2026-56850

Vulnerability Analysis

The Node.js https.Agent maintains a pool of keep-alive sockets keyed by connection parameters, including the client certificate material. When TLS credentials are provided as an array of PFX objects through the pfx option, the Agent's key-generation routine does not uniquely serialize the array contents. Distinct PFX arrays produce identical cache keys, causing the Agent to treat requests with different client identities as interchangeable.

An attacker or a misconfigured caller that shares the same Agent instance can therefore obtain a socket already authenticated with another tenant's certificate. This breaks the identity guarantees that mTLS is intended to provide between the Node.js client and the remote server.

Root Cause

The root cause is improper authentication [CWE-287] arising from an incomplete cache-key derivation. The Agent hashes connection options into a session key but does not distinguish PFX object arrays that differ in content. This produces a collision that violates the assumption that each cache entry corresponds to a single client identity.

Attack Vector

Exploitation requires local, high-privilege influence over the Node.js process configuration. The CVSS 3.0 vector AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N reflects a local integrity attack that requires an authenticated actor able to submit requests through the shared HTTPS Agent. There is no confidentiality or availability impact reported, and no public proof-of-concept is available. See the Node.js July 2026 Security Blog for technical details.

No verified exploit code is available. The vulnerability is described in prose only.

Detection Methods for CVE-2026-56850

Indicators of Compromise

Outbound mTLS requests from Node.js services reaching backends authenticated with a client certificate that does not match the request's intended identity.
Backend access logs showing an mTLS client subject associated with API calls originated by a different tenant or workflow.
Unexpected reuse of long-lived keep-alive sockets across code paths that configure distinct PFX certificate arrays.

Detection Strategies

Inventory Node.js runtimes in production and identify hosts running 22.x, 24.x, or 26.x prior to the July 2026 security releases.
Audit application code for use of https.Agent with the pfx option supplied as an array of objects, especially where a single Agent is shared across tenants.
Instrument HTTPS clients to log the client certificate subject actually presented on each request and compare it to the requested identity.

Monitoring Recommendations

Correlate mTLS authentication events on backend services with the calling workload to flag identity mismatches.
Alert on Node.js processes that instantiate global HTTPS Agents handling multiple distinct PFX certificates.
Track upgrade compliance for Node.js LTS lines through software composition analysis and endpoint telemetry.

How to Mitigate CVE-2026-56850

Immediate Actions Required

Upgrade Node.js to the patched releases published in the Node.js July 2026 Security Blog for the 22.x, 24.x, and 26.x lines.
Restart long-running Node.js services after patching to invalidate any cached TLS sockets created under the vulnerable Agent.
Review multi-tenant HTTPS clients that share Agents across identities and refactor them to isolate certificates.

Patch Information

The Node.js project addresses the collision in the July 2026 security releases for the 22.x, 24.x, and 26.x branches. Refer to the Node.js July 2026 Security Blog for exact patched version numbers and release artifacts.

Workarounds

Use a dedicated https.Agent instance per client identity so that PFX arrays never share a socket pool.
Disable keep-alive (keepAlive: false) on Agents that must serve multiple mTLS identities until the runtime is patched.
Convert PFX object arrays to a single PFX buffer where feasible to avoid the array-keying path that produces collisions.

bash

# Configuration example: isolate Agents per identity
# Refer to Node.js documentation and the July 2026 security advisory
# for concrete API guidance before applying changes in production.