CVE-2026-84197: CWE-295 Improper certificate validation in Eclipse Foundation Eclipse Ditto

CVE-2026-84197 describes an improper certificate validation vulnerability (CWE-295) in Eclipse Ditto's Node.js JavaScript client. The WebSocket transport hard-codes rejectUnauthorized: false, disabling certificate chain and hostname validation for all wss:// connections. No configuration option exists to enable validation. This flaw enables a man-in-the-middle attacker to complete TLS handshakes with arbitrary certificates, intercept Authorization headers, and manipulate Ditto Protocol messages during the connection lifetime. The vulnerability affects all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to before 3.8.1 and from 3.9.0 to before 3.9.1, as well as the predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0. Other clients and transports are unaffected.

An attacker capable of intercepting network traffic can bypass TLS certificate validation on WebSocket connections, allowing them to impersonate the server with arbitrary certificates. This leads to exposure of authentication credentials sent in the Authorization header and enables reading, altering, or injecting protocol messages. This compromises confidentiality and integrity of communications between the client and server for the duration of the connection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions of the Node.js JavaScript client for WebSocket transport in untrusted networks. Consider using alternative clients or transports that are not affected, such as the Java client, browser/DOM JavaScript client, or HTTP transport. Monitor the Eclipse Foundation advisories for updates and apply official patches once released.