CVE-2026-56850 describes a flaw in the Node.js HTTPS Agent's connection reuse mechanism where PFX object-array key collisions occur. This allows mTLS client identities to be reused improperly across different requests configured with distinct client certificates. The vulnerability affects Node.js versions 22.x, 24.x, and 26.x. The CVSS vector indicates the attack requires local access with high privileges and no user interaction, with moderate complexity, and impacts integrity but not confidentiality or availability.

The vulnerability can lead to the reuse of mTLS client identities across requests that should have distinct client certificates, potentially causing unauthorized identity reuse in mutual TLS authentication scenarios. This impacts the integrity of client authentication but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, review usage of mTLS client certificates in Node.js HTTPS Agent connection reuse contexts and consider avoiding connection reuse if possible.