Threats tagged 'ghsa-4g6g-xjc7-fh73'

A certificate validation bypass vulnerability exists in Node.js https.Agent where cached TLS sessions authenticated under a broader CA policy can be reused in connections with stricter CA policies. This occurs because the session cache key does not differentiate between omitted and empty CA arrays, allowing a TLS 1.3 session authenticated with the default trust store to be resumed in a connection that explicitly supplies an empty CA list. This leads to unauthorized acceptance of TLS sessions and potential exposure of confidential data. The issue affects Node.js versions 22.x, 24.x, and 26.x.