Search: CVE-2026-58040

CVE-2026-58040 is a vulnerability in Node.js versions 22.x, 24.x, and 26.x where the HTTPS Agent's TLS session reuse mechanism skips hostname verification across identity policies. This issue is an incomplete fix of a previous vulnerability (CVE-2026-48934). The vulnerability has a medium severity with a CVSS score of 6.3 and does not have any known exploits in the wild at this time.