This vulnerability arises from an inconsistency in how Node.js performs hostname matching in multi-context mTLS configurations. This inconsistency can cause a bypass of trust policies, potentially allowing an attacker with limited privileges to circumvent intended access controls. The issue affects specific Node.js versions 22.22.3, 24.16.0, and 26.3.0. The CVSS 3.0 base score is 4.2, reflecting a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and low impact on confidentiality and integrity without availability impact. No known exploits are reported in the wild, and no official remediation or patch has been published yet.

The vulnerability could allow an attacker to bypass trust policies in multi-context mTLS setups, potentially leading to unauthorized access or privilege escalation within affected Node.js environments. The impact on confidentiality and integrity is low, and availability is not affected. Exploitation complexity is high, and the attacker requires low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review their multi-context mTLS configurations and consider additional access control measures to mitigate potential risks. Monitor official Node.js security advisories for updates.