This vulnerability in Node.js arises from an incomplete fix to a previous issue (CVE-2026-48934). Specifically, when the HTTPS Agent reuses TLS sessions, it skips hostname verification across identity policies. This flaw affects Node.js versions 22.23.1, 24.18.0, and 26.5.0. The CVSS 3.0 base score is 6.3, indicating a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

An attacker could potentially bypass hostname verification during TLS session reuse, which may lead to exposure of sensitive information due to improper validation of the server's identity. The confidentiality impact is high, but integrity and availability are not affected. The vulnerability requires low privileges and has a high attack complexity, limiting ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is indicated, users should monitor Node.js vendor advisories for updates. Until a fix is available, consider avoiding affected versions or disabling TLS session reuse if feasible in your environment.