CVE-2026-58040

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58040", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-06-27T15:00:00.779Z", "datePublished": "2026-07-30T06:02:49.942Z", "dateUpdated": "2026-07-30T12:50:20.213Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."}], "affected": [{"defaultStatus": "unaffected", "vendor": "nodejs", "product": "node", "versions": [{"version": "22.23.1", "status": "affected", "lessThanOrEqual": "22.23.1", "versionType": "semver"}, {"version": "24.18.0", "status": "affected", "lessThanOrEqual": "24.18.0", "versionType": "semver"}, {"version": "26.5.0", "status": "affected", "lessThanOrEqual": "26.5.0", "versionType": "semver"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-30T06:02:49.942Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-297", "lang": "en", "description": "CWE-297 Improper Validation of Certificate with Host Mismatch"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-30T12:47:40.363604Z", "id": "CVE-2026-58040", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T12:50:20.213Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58040", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-06-27T15:00:00.779Z", "datePublished": "2026-07-30T06:02:49.942Z", "dateUpdated": "2026-07-30T12:50:20.213Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."}], "affected": [{"defaultStatus": "unaffected", "vendor": "nodejs", "product": "node", "versions": [{"version": "22.23.1", "status": "affected", "lessThanOrEqual": "22.23.1", "versionType": "semver"}, {"version": "24.18.0", "status": "affected", "lessThanOrEqual": "24.18.0", "versionType": "semver"}, {"version": "26.5.0", "status": "affected", "lessThanOrEqual": "26.5.0", "versionType": "semver"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-30T06:02:49.942Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58040", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T12:47:40.363604Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-297", "description": "CWE-297 Improper Validation of Certificate with Host Mismatch"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T12:48:39.215Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "node", "vendor": "nodejs", "versions": [{"lessThanOrEqual": "22.23.1", "status": "affected", "version": "22.23.1", "versionType": "semver"}, {"lessThanOrEqual": "24.18.0", "status": "affected", "version": "24.18.0", "versionType": "semver"}, {"lessThanOrEqual": "26.5.0", "status": "affected", "version": "26.5.0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."}, {"lang": "es", "value": "Se ha identificado una correcci\u00f3n incompleta en Node.js: la reutilizaci\u00f3n de sesi\u00f3n TLS del Agente HTTPS omite la verificaci\u00f3n de nombre de host entre pol\u00edticas de identidad (correcci\u00f3n incompleta de CVE-2026-48934).\n\nEsta vulnerabilidad afecta a Node.js 22.x, 24.x, y 26.x."}], "id": "CVE-2026-58040", "lastModified": "2026-10-23T22:10:00.160", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58040", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-30T12:47:40.363604Z", "version": "2.0.3"}}]}, "published": "2026-07-30T06:25:55.190", "references": [{"source": "support@hackerone.com", "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-297"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:48273", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "nodejs26-main-26.5.1-1.5.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-29T00:00:00Z"}, {"advisory": "RHSA-2026:48305", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "nodejs22-main-22.23.2-2.3.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-29T00:00:00Z"}, {"advisory": "RHSA-2026:48537", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "nodejs24-main-24.18.1-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-30T00:00:00Z"}], "bugzilla": {"description": "nodejs: HTTPS Agent TLS session reuse skips hostname verification", "id": "2509175", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509175"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-322", "details": ["A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security (TLS) sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to information disclosure or other security breaches."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes."}, "name": "CVE-2026-58040", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "nodejs22", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "nodejs24", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs20", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs25", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-30T06:02:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58040\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58040\nhttps://nodejs.org/en/blog/vulnerability/july-2026-security-releases"], "statement": "This issue is rated Moderate (CVSS 6.3) because successful exploitation allows session-hijacking and information disclosure without affecting system integrity or availability (C:H, I:N, A:N). The flaw occurs when an HTTPS Agent reuses an existing TLS session across requests with differing identity policies, skipping host verification. An attacker must already sit in a privileged network position (AV:N/AC:H) to perform a man-in-the-middle attack and intercept traffic intended for a distinct target on the same TLS session.\nApplications that explicitly configure unique HTTPS agents per target host, avoid TLS session caching, or do not make outbound HTTPS requests to varied third-party endpoints using shared client instances are not at risk.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.23.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "24.18.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "26.5.0"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "node", "source": "cna", "vendor": "nodejs"}, "product": "nodejs", "vendor": "nodejs"}], "created": "2026-07-30T13:30:04.210149+00:00", "updated": "2026-08-05T14:15:07.161503+00:00", "vendors": ["nodejs", "nodejs$PRODUCT$nodejs"]}