This vulnerability in Node.js affects the HTTPS Agent's TLS session reuse functionality, causing it to skip hostname verification across identity policies. It represents an incomplete fix of CVE-2026-48934, meaning the underlying issue was not fully resolved. The flaw is present in Node.js versions 22.x, 24.x, and 26.x. The CVSS 3.0 score is 6.3, indicating a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impact limited to confidentiality. No vendor advisory or patch information is provided, and no known exploits have been reported.

The vulnerability allows TLS session reuse without proper hostname verification, which could lead to confidentiality breaches if an attacker can exploit this flaw. However, the attack complexity is high, and privileges required are low, with no impact on integrity or availability. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor Node.js vendor advisories for updates addressing this incomplete fix. Until a patch is available, cautious use of affected Node.js versions is advised.