This vulnerability in Node.js TLS host verification (CWE-295) allows an attacker to bypass certification validation, which could lead to connections being established without proper verification of the server's identity. The flaw affects all supported Node.js release lines: 22.22.3, 24.16.0, and 26.3.0. The CVSS v3.0 score is 4.3 (medium), reflecting a network attack vector with low complexity and requiring low privileges, but resulting in limited confidentiality impact and no integrity or availability impact. No patch or official remediation guidance is currently available.

An attacker exploiting this vulnerability could bypass TLS certificate validation, potentially enabling man-in-the-middle attacks or interception of supposedly secure communications. However, the impact is limited to confidentiality with no known integrity or availability consequences. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider additional TLS validation measures or avoid using affected Node.js versions in high-risk environments.