Threats tagged 'ghsa-v64j-2jhv-ww23'

A vulnerability in Node.js TLS allows a client to bypass client certificate authentication by changing the servername during TLS 1.2 renegotiation. This enables a client authenticated for a less restrictive host to access endpoints with stricter client-certificate policies, effectively bypassing intended access controls. The issue affects Node.js versions 22.x, 24.x, and 26.x.