CVE-2026-56850: A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

CVE-2026-56850 is a vulnerability in A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**., rated Moderate by Microsoft, with a CVSS 3.1 base score of 4.1 (Medium). An attacker can exploit it by an attacker with local access, with high privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.11% probability of exploitation activity in the next 30 days, higher than 1% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Open Source Software).

Key facts

CVE ID: CVE-2026-56850
Severity: Medium CVSS 4.1
Microsoft severity: Moderate
Exploited in the wild: No
Publicly disclosed: No
Weakness: CWE-287
EPSS: 0.11% (percentile 1%)
CISA KEV: Not listed
Released: 6 August 2026
Last updated: 6 August 2026
Patch Tuesday: July 2026 Patch Tuesday
Product families: Open Source Software

CVSS score and vector

Microsoft scores CVE-2026-56850 at 4.1 (temporal 4.1) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

Metric	Value
Attack vector	Local
Attack complexity	High
Privileges required	High
User interaction	None
Scope	Unchanged
Confidentiality impact	None
Integrity impact	High
Availability impact	None

NVD scores it 4.4 (MEDIUM) with CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.

Affected products (1)

Open Source Software

Product	Security update	Type	Fixed build	Restart
azl3 nodejs 24.17.0-1 on Azure Linux 3.0	CBL-Mariner Releases	Security Update	24.18.1-1	No

Exploitation and detection

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (1)

CompleteTech-Security/node-cve-2026-56850-check

NIST NVD data

NVD status: Analyzed
NVD CVSS: 4.4 (MEDIUM)
NVD weakness: CWE-287
Published to NVD: 30 July 2026
NVD last modified: 25 August 2026

Affected configurations (CPE)

Product	Vulnerable versions
node.js	from 22.0, up to and including 22.23.1
node.js	from 24.0.0, up to and including 24.18.0
node.js	from 26.0.0, up to and including 26.5.0

References

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases (Vendor Advisory)

Revision history

Version	Date	Description
1.0	6 August 2026	Information published.

CVE-2026-56850: A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.