CVE-2026-84197: Eclipse Ditto Node.js Client Vulnerability

CVE-2026-84197 Overview

CVE-2026-84197 affects the Eclipse Ditto Node.js JavaScript client, where the WebSocket transport hard-codes rejectUnauthorized: false when constructing the underlying ws WebSocket connection. This disables certificate chain and hostname validation for every wss:// connection. No builder option, constructor argument, or environment variable allows applications to re-enable validation. The flaw maps to Improper Certificate Validation [CWE-295] and enables man-in-the-middle interception of authenticated Ditto Protocol traffic.

Critical Impact
An on-path attacker can intercept WebSocket connections, capture credentials from the Authorization header, and read, alter, or inject Ditto Protocol messages for the connection lifetime.

Affected Products

@eclipse-ditto/ditto-javascript-client-node versions 2.0.0 through 3.9.0
@eclipse-ditto/ditto-javascript-client-node_1.0 versions 1.0.0 through 2.1.0
WebSocket transport of the Node.js client only (Java client, browser/DOM JavaScript client, and Node.js HTTP transport are not affected)

Discovery Timeline

2026-09-08 - CVE-2026-84197 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-84197

Vulnerability Analysis

The Eclipse Ditto Node.js client provides a WebSocket transport for communicating with a Ditto backend over wss://. When the transport instantiates the underlying ws library WebSocket, it passes rejectUnauthorized: false as a hard-coded option. This flag instructs Node.js TLS to accept any server certificate, regardless of chain validity, expiration, or hostname mismatch.

Because the setting is embedded in the client source, no configuration surface exists to override it. Applications that follow the documented configuration API still initiate TLS handshakes with validation disabled. Every authenticated wss:// session inherits the weakened trust posture.

Root Cause

The root cause is Improper Certificate Validation [CWE-295] introduced by a hard-coded TLS option in the WebSocket transport implementation. Secure defaults were replaced with permissive defaults, and no override mechanism was exposed through the builder, constructor, or environment.

Attack Vector

An attacker positioned on the network path between the Node.js client and the Ditto backend can present an arbitrary TLS certificate. The client completes the handshake without objection. The attacker then reads the Authorization header sent during the WebSocket upgrade, capturing bearer tokens, basic credentials, or other authentication material used by the configured provider.

Once the session is established, the attacker can passively observe Ditto Protocol messages, tamper with commands and events in transit, or inject arbitrary protocol frames. Compromise persists for the lifetime of the WebSocket connection. Exploitation requires network-adjacent interception capability such as ARP spoofing, rogue Wi-Fi, DNS hijacking, or compromised upstream infrastructure.

Refer to the Eclipse Vulnerability Report #660 for technical details.

Detection Methods for CVE-2026-84197

Indicators of Compromise

Unexpected TLS certificates presented by hosts serving the Ditto WebSocket endpoint, particularly certificates not signed by the expected internal or public CA
Ditto Protocol messages containing commands or state changes that do not correlate with legitimate application activity
New or unrecognized network paths between Node.js clients and the Ditto backend, including transparent proxies or unexpected TLS-terminating middleboxes

Detection Strategies

Inventory Node.js applications and CI/CD pipelines for the affected @eclipse-ditto/ditto-javascript-client-node package versions using SBOM tooling or npm ls
Perform TLS certificate pinning validation externally by comparing observed server certificates against the expected fingerprint
Correlate network flow telemetry with Ditto backend logs to identify sessions traversing unexpected network segments

Monitoring Recommendations

Enable verbose TLS handshake logging on the Ditto backend and alert on client versions or User-Agents matching the vulnerable Node.js client
Monitor for anomalous Ditto Protocol message rates, unexpected command sources, or authentication events from new IP ranges
Watch for outbound connections from application hosts to non-approved destinations on the WebSocket port

How to Mitigate CVE-2026-84197

Immediate Actions Required

Identify all Node.js services that depend on the affected package ranges and treat any credentials transmitted through the WebSocket transport as potentially compromised
Rotate authentication tokens, API keys, and passwords used by the Ditto authentication provider on affected clients
Restrict client egress to the Ditto backend through allowlisted network paths that eliminate untrusted intermediaries until a fixed release is available

Patch Information

At the time of publication, no fixed release is referenced in the enriched CVE data. Monitor the Eclipse Vulnerability Report #660 for patched versions of @eclipse-ditto/ditto-javascript-client-node and its _1.0 predecessor package. Upgrade all affected deployments once a fix is released.

Workarounds

Switch the Node.js client from the WebSocket transport to the HTTP transport, which is not affected by this issue
Route WebSocket traffic through a trusted local proxy that performs certificate validation and pinning before forwarding to the Ditto backend
Deploy the client only on isolated network segments where on-path interception is not feasible until a patched release is adopted

bash

# Identify affected package versions in a Node.js project
npm ls @eclipse-ditto/ditto-javascript-client-node
npm ls @eclipse-ditto/ditto-javascript-client-node_1.0