What is CVE-2026-123877?
A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
The record classifies CVE-2026-123877 under weakness class CWE-295. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 1 day ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 6.8 — MEDIUM
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 3.4/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-11-11
Is CVE-2026-123877 being exploited?
It currently carries a trending score of 5 in the Threadlinqs vulnerability feed.
Affected products and versions
- nodejs: node
How to fix CVE-2026-123877
Vendor advisory: https://nodejs.org/en/blog/vulnerability/november-2026-security-releases. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2026-123877
1 tracked threat in the Threadlinqs corpus references CVE-2026-123877, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Enriched from CVE.org, NVD. This product uses the NVD API but is not endorsed or certified by the NVD.