Node.js · Report #3816840
HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates
Validstatus
mediumseverity
24upvotes
29 Jul 2026disclosed
Summary
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.