Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2026-58040: Node.js HTTPS may skip host verification, enabling spoofing
CVE-2026-58040 · published 3 months ago
Summary
Versions 22.x, 24.x and 26.x of Node.js can reuse TLS sessions without checking that the server name matches the certificate. This means an attacker could intercept and pretend to be a legitimate website, potentially stealing data. Update Node.js to the latest patched release or apply the vendor’s recommended fix as soon as possible.
What to do
- Update alpine nodejs to version 22.23.2-r0.
- Update alpine nodejs to version 24.18.1-r0.
- Update bellsoft nodejs to version 24.18.1-r0.
- Update bellsoft nodejs to version 22.23.2-r0.
- Update debian nodejs to version 24.19.0+dfsg+~cs24.13.3-1.
- Update nodejs to version 22.23.2-r0.
- Update nodejs to version 24.18.1-r0.
- Update debian nodejs to version 18.20.4+dfsg-1~deb12u3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | nodejs | node | <= 22.23.1 |
| Alpine:v3.22 | alpine | nodejs |
< 22.23.2-r0 Fix: upgrade to 22.23.2-r0
|
| Alpine:v3.23 | alpine | nodejs |
< 24.18.1-r0 Fix: upgrade to 24.18.1-r0
|
| Alpine:v3.24 | alpine | nodejs |
< 24.18.1-r0 Fix: upgrade to 24.18.1-r0
|
| Debian:11 | debian | nodejs | All versions |
| Debian:12 | debian | nodejs |
< 18.20.4+dfsg-1~deb12u3 Fix: upgrade to 18.20.4+dfsg-1~deb12u3
|
| Debian:13 | debian | nodejs | All versions |
| Debian:14 | debian | nodejs |
< 24.19.0+dfsg+~cs24.13.3-1 Fix: upgrade to 24.19.0+dfsg+~cs24.13.3-1
|
| BellSoft Hardened Containers:stream | bellsoft | nodejs |
>= 18.16.1-r0, < 24.18.1-r0 Fix: upgrade to 24.18.1-r0
|
| Alpaquita:25 | bellsoft | nodejs |
>= 22.16.0-r1, < 22.23.2-r0 Fix: upgrade to 22.23.2-r0
|
| Alpaquita:stream | bellsoft | nodejs |
>= 18.16.1-r0, < 24.18.1-r0 Fix: upgrade to 24.18.1-r0
|
| Alpine:v3.21 | alpine | nodejs |
< 22.23.2-r0 Fix: upgrade to 22.23.2-r0
|
| BellSoft Hardened Containers:25 | bellsoft | nodejs |
>= 22.16.0-r1, < 22.23.2-r0 Fix: upgrade to 22.23.2-r0
|
| Alpine:v3.21 | – | nodejs |
< 22.23.2-r0 Fix: upgrade to 22.23.2-r0
|
| Alpine:v3.23 | – | nodejs |
< 24.18.1-r0 Fix: upgrade to 24.18.1-r0
|
| Ubuntu:Pro:14.04:LTS | canonical | nodejs | All versions |
Original advisory text
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).
This vulnerability affect...
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).
This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
References
- https://nodejs.org/en/blog/vulnerability/july-2026-security-releases
- https://security.alpinelinux.org/vuln/CVE-2026-58040 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-58040 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-58040 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-58040 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-58040 Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#https-agent... Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-297Improper Validation of Certificate with Host Mismatch
Timeline
Published30 Jul 2026
Updated3 Nov 2026
First seen30 Jul 2026
Sources
CVE-2026-58040 · NVD
CVE-2026-58040 · MITRE
ALPINE-CVE-2026-58040 · OSV
DEBIAN-CVE-2026-58040 · OSV
BELL-CVE-2026-58040 · OSV
UBUNTU-CVE-2026-58040 · OSV
Track software like this
Free during beta