CVE-2026-123867 Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA
A client with a certificate trusted by the default CA can bypass per-host mTLS authorization to reach protected hostnames in Node.js TLS servers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- Yes
- Fix
- Available
What is CVE-2026-123867?
CVE-2026-123867 is a medium-severity authentication bypass vulnerability in nodejs node, published on 11 Nov 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, { ca: protectedCA })` but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In `src/crypto/crypto_tls.cc`, `CertCbDone` installs the SNI context's CA only when `setSniContext` succeeds, but `setSniContext` returns `false` for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with `requestCert` and `rejectUnauthorized` enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Weakness: CWE-295
Which versions are affected by CVE-2026-123867?
An affected version is only exploitable if your software calls CertCbDone or setSniContext. Many projects that include it are not exposed.
How do I fix CVE-2026-123867?
No fix published yet.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-123867 being exploited?
There is no known exploitation of CVE-2026-123867 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-123867, BELL-CVE-2026-123867, DEBIAN-CVE-2026-123867, GHSA-xhqh-vr6v-3wgj, UBUNTU-CVE-2026-123867.