CVE-2026-58040

What it actually does

CVE-2026-58040 is a cryptographic validation weakness in Node.js 22.x, 24.x, and 26.x where the HTTPS Agent can incorrectly reuse a TLS session across different hostname identity policies and skip the expected hostname verification step. Because the flaw is an incomplete fix for an earlier TLS session-reuse issue, an outbound HTTPS client running on affected Node.js versions may accept a resumed TLS session in a context where the peer certificate should have been revalidated against a different hostname or identity requirement. The primary technical consequence is loss of server-authentication assurance for affected Node.js HTTPS clients, creating a confidentiality risk if an attacker can position themselves in the network path or otherwise influence connection routing and certificate/session behavior.

Why it matters to the business

Applications that use affected Node.js runtimes for outbound HTTPS requests may trust the wrong remote service under specific connection-reuse conditions. In practical terms, this could allow sensitive data sent by backend services, API clients, automation jobs, or integrations to be exposed to an attacker-controlled endpoint. The CVSS score is moderate and EPSS is currently low, with no known KEV listing or public exploit maturity reported, but the issue affects supported Node.js major versions and should be prioritized for systems that make HTTPS requests to multiple hosts, handle secrets, tokens, customer data, or operate in networks where interception, proxying, or DNS manipulation is plausible.

How an attack unfolds

An attacker first needs a position where they can influence or observe a victim Node.js application's outbound HTTPS traffic, such as a malicious network, compromised proxy path, DNS manipulation point, service mesh misconfiguration, or a malicious endpoint that the application legitimately contacts. The attacker then attempts to cause the Node.js HTTPS Agent to establish or reuse a TLS session in a way that crosses hostname or identity-policy boundaries. If the vulnerable runtime incorrectly reuses the TLS session and skips hostname verification, the application may treat the attacker-controlled or wrong service as a trusted destination. The attacker can then receive confidential data that the application intended to send over HTTPS to another hostname. Exploitation is not a simple unauthenticated remote takeover; it requires specific traffic patterns, outbound HTTPS usage, and an attacker capable of influencing connection/session reuse conditions.

How to fix it

Upgrade affected Node.js packages to the fixed vendor versions or later. For Red Hat packages, upgrade nodejs22-main to 22.23.2-2.3.hum1 or later, nodejs24-main to 24.18.1-0.1.hum1 or later, and nodejs26-main to 26.5.1-1.5.hum1 or later as provided in RHSA-2026:48273. Rebuild and redeploy container images, serverless runtimes, CI images, and application bundles that embed affected Node.js versions. If immediate upgrade is not possible, reduce risk by disabling or limiting TLS session reuse where feasible, avoiding shared HTTPS Agent instances across destinations with different trust or identity requirements, using separate agents per hostname/security policy, enforcing strict certificate validation, and restricting outbound network paths through trusted egress proxies. Treat mitigations as temporary because the durable fix is to deploy a corrected Node.js runtime.

How to confirm the fix worked

Confirm the installed runtime and package versions are fixed: Node.js 22 should be at least the vendor-fixed 22.23.2-2.3.hum1 build, Node.js 24 should be at least 24.18.1-0.1.hum1, and Node.js 26 should be at least 26.5.1-1.5.hum1 for the listed Red Hat packages. Validate both host-installed runtimes and embedded copies in containers, build images, developer tooling, and application deployment artifacts. Run package-manager checks for RHSA-2026:48273 and verify no affected nodejs22-main, nodejs24-main, or nodejs26-main packages remain. Application teams should test outbound HTTPS integrations after upgrade and, where possible, add regression tests that ensure requests to different hostnames with different certificates or trust policies fail when hostname verification should fail.

Typical attack path

1. Identify or create a position to influence the target application's outbound HTTPS connections, such as via network interception, DNS manipulation, proxy control, or a malicious service endpoint.
2. Wait for or induce the affected Node.js application to make HTTPS requests using the built-in HTTPS Agent with connection/session reuse enabled.
3. Cause TLS session reuse to occur across requests that should have different hostname or identity verification requirements.
4. Rely on the vulnerable Node.js runtime to skip hostname verification during the resumed TLS session.
5. Receive or intercept sensitive outbound HTTPS data that the application incorrectly sends to the wrong or attacker-controlled endpoint.
6. Use exposed credentials, tokens, API payloads, or confidential data for follow-on access or data theft.

How to detect it

This vulnerability is difficult to confirm through a single log entry because exploitation abuses TLS session reuse and skipped hostname verification inside the client runtime. Focus retrospective analysis on applications running affected Node.js versions that make outbound HTTPS requests. Review application logs, egress proxy logs, DNS logs, service mesh telemetry, firewall logs, and TLS inspection metadata for requests to unexpected hostnames, IP addresses, or proxies around the time sensitive outbound API calls occurred. Look for certificate or hostname mismatch warnings, suppressed TLS validation errors, anomalous TLS session resumption patterns across different destination hostnames, sudden DNS answer changes, HTTP requests to lookalike domains, and outbound connections to infrastructure not normally associated with configured API endpoints. If full packet capture or proxy telemetry is available, compare SNI, destination IP, certificate subject/SAN, and application-request Host headers for inconsistencies. Also examine recent configuration changes to proxies, DNS, service mesh routing, and environment variables such as proxy settings that could have enabled traffic redirection. There are no public threat actors or campaigns reported for this CVE in the provided data, so detection should be behavior-focused rather than actor-specific.

• Node.js v22.x prior to 22.23.2-2.3.hum1
• Node.js v24.x prior to 24.18.1-0.1.hum1
• Node.js v26.x prior to 26.5.1-1.5.hum1
• nodejs22-main versions prior to 22.23.2-2.3.hum1
• nodejs24-main versions prior to 24.18.1-0.1.hum1
• nodejs26-main versions prior to 26.5.1-1.5.hum1
• RHSA-2026:48273
• Hostname/IP does not match certificate's altnames
• ERR_TLS_CERT_ALTNAME_INVALID
• DEPTH_ZERO_SELF_SIGNED_CERT
• UNABLE_TO_VERIFY_LEAF_SIGNATURE
• NODE_TLS_REJECT_UNAUTHORIZED=0
• HTTPS_PROXY=
• HTTP_PROXY=
• NO_PROXY=

What your security team should do

• Inventory all Node.js 22.x, 24.x, and 26.x deployments, including containers, CI/CD images, serverless packages, appliance-like deployments, and developer-built application artifacts.
• Prioritize upgrades for applications that make outbound HTTPS requests to multiple domains, communicate with third-party APIs, transmit secrets or tokens, or run in environments with complex proxying, service mesh, or DNS controls.
• Deploy the fixed Red Hat packages from RHSA-2026:48273: nodejs22-main 22.23.2-2.3.hum1 or later, nodejs24-main 24.18.1-0.1.hum1 or later, and nodejs26-main 26.5.1-1.5.hum1 or later.
• Rebuild and redeploy all container images and application bundles that include affected Node.js runtimes rather than only patching base hosts.
• Review application code for shared HTTPS Agent usage across unrelated hosts or differing certificate validation policies, and separate agents by hostname or trust boundary where practical.
• Monitor outbound HTTPS traffic for unexpected destination changes, certificate mismatches, unusual proxy routing, or sensitive API calls going to nonstandard endpoints.
• Because there is no KEV listing, no reported ransomware use, low EPSS, and no known exploit maturity, handle as a timely patching item rather than an emergency internet-wide exploitation event, while escalating priority for high-sensitivity outbound integrations.