CVE-2026-58040: Node.js HTTPS Agent TLS Vulnerability

CVE-2026-58040 Overview

CVE-2026-58040 is an incomplete fix vulnerability in Node.js affecting the HTTPS Agent. The flaw allows TLS session reuse across different identity policies without proper hostname verification. This issue is a regression of the earlier CVE-2026-48934 fix, which failed to fully close the certificate validation gap. The vulnerability affects Node.js versions 22.x, 24.x, and 26.x.

Critical Impact
Attackers positioned to serve a valid TLS certificate for one hostname can have that session reused for connections intended for a different hostname, undermining TLS identity guarantees and enabling confidentiality bypass under specific network conditions.

Affected Products

Node.js 22.x
Node.js 24.x
Node.js 26.x

Discovery Timeline

2026-07-30 - CVE-2026-58040 published to NVD
2026-07-30 - Last updated in NVD database
July 2026 - Node.js publishes security release addressing the incomplete fix (see Node.js July 2026 Security Blog)

Technical Details for CVE-2026-58040

Vulnerability Analysis

The vulnerability resides in the Node.js core https module, specifically in how the built-in https.Agent caches and reuses TLS sessions. TLS session reuse is a performance optimization that allows clients to resume prior sessions without a full handshake. Node.js keys these cached sessions in a way that does not sufficiently isolate sessions established under different identity policies, such as differing hostnames, Server Name Indication (SNI) values, or certificate authority pinning constraints.

When a subsequent HTTPS request targets a host that maps to a cached session established for a different identity policy, the agent may reuse the existing session and bypass the hostname verification that would normally occur during a fresh handshake. This is classified as an Improper Certificate Validation issue.

This flaw is an incomplete remediation of CVE-2026-48934. The original patch narrowed the session cache scope but did not cover all identity policy boundaries, leaving a residual bypass path.

Root Cause

The root cause is insufficient cache-key composition inside the HTTPS Agent. Session cache entries are keyed on connection parameters that do not fully capture identity policy state. As a result, hostname validation, which normally executes during certificate verification on new connections, is effectively skipped on session resumption.

Attack Vector

Exploitation requires a network-positioned adversary and low privileges on the calling application. The attacker must influence the application into making a first HTTPS connection where the attacker controls a valid certificate for a hostname, then trigger a second connection to a different target that reuses the cached session. Attack complexity is high because it depends on specific application connection patterns and cache state. See the Node.js July 2026 Security Blog for the vendor description.

Detection Methods for CVE-2026-58040

Indicators of Compromise

Unexpected TLS session resumption events in Node.js application logs where the resumed session's original hostname does not match the current request target.
Outbound HTTPS connections that skip certificate chain validation logging on hosts running vulnerable Node.js runtimes.
Anomalous reuse of TLS session tickets across unrelated destination hostnames from the same Node.js process.

Detection Strategies

Inventory all Node.js runtimes across servers, containers, and CI systems and flag any instance on 22.x, 24.x, or 26.x below the July 2026 patched release.
Instrument applications with the tls module's session and keylog events to correlate resumed sessions against intended destination hostnames.
Monitor egress TLS traffic for session resumption patterns that cross hostname boundaries within a single process.

Monitoring Recommendations

Ingest Node.js process and TLS telemetry into a centralized SIEM or data lake and alert on repeated session resumption across differing SNI values.
Track software bill of materials (SBOM) data to detect newly deployed workloads that pin vulnerable Node.js versions.
Review outbound proxy logs for HTTPS clients that fail to renegotiate on hostname change.

How to Mitigate CVE-2026-58040

Immediate Actions Required

Upgrade all Node.js deployments to the patched releases for the 22.x, 24.x, and 26.x lines as published in the July 2026 Node.js security release.
Audit application code that constructs custom https.Agent instances with keepAlive: true and validate hostname handling for reused sessions.
Rotate any TLS session tickets and credentials that may have been exposed through resumed sessions.

Patch Information

Node.js addressed CVE-2026-58040 in the July 2026 security releases for the 22.x, 24.x, and 26.x branches. The patched builds correct the HTTPS Agent session cache keying so that hostname verification is enforced across identity policy boundaries. Refer to the Node.js July 2026 Security Blog for exact fixed version numbers and upgrade instructions.

Workarounds

Disable HTTPS Agent session reuse by setting maxCachedSessions: 0 on the https.Agent constructor for applications that cannot be patched immediately.
Set keepAlive: false on custom agents to force fresh handshakes and full certificate validation on every request.
Restrict outbound HTTPS destinations using egress filtering so that a single Node.js process only communicates with a bounded set of hostnames.

bash

# Configuration example: disable TLS session reuse in Node.js HTTPS Agent
const https = require('https');
const agent = new https.Agent({
  keepAlive: false,
  maxCachedSessions: 0
});

https.request({ host: 'example.com', agent }, (res) => {
  // handle response
});