CVE-2026-56850

4.4 medium exploit ×2 SSVC exploitation: none Analyzed

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Fix

Public exploits 2

CompleTetech-Security/node-cve-2026-56850-check PoC on GitHub
completetech-security/node-cve-2026-56850-check PoC on GitHub

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

Patch, vendor advisory and mitigation references on NVD 1

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 1

2026-10-23 22:28First seenCVSS 4.4 · nodejsNVD modified 2026-10-23 22:10

Affected (CPE criteria) 1

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

References 1

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases Vendor Advisory