A vulnerability in Node.js allows a client authorized for the default hostname to bypass per-host mutual TLS (mTLS) authorization and access a protected hostname it is not authorized for. This occurs when a TLS server configures a hostname with a client-certificate CA but no server certificate, causing the client CA to fall back to the default. As a result, a client trusted by the default CA can complete mTLS to the protected hostname despite lacking proper authorization. This affects Node.js versions 22.x, 24.x, and 26.x.