CVE-2026-123872 Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change
A client holding a certificate for one host can change the servername during TLS renegotiation to reach protected hosts with weaker client-cert policies; Node.js TLS users should care.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- Yes
- Fix
- Available
What is CVE-2026-123872?
CVE-2026-123872 is a high-severity authentication bypass vulnerability in nodejs node, published on 11 Nov 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Weakness: CWE-287
Which versions are affected by CVE-2026-123872?
An affected version is only exploitable if your software uses the vulnerable function or option. Many projects that include it are not exposed.
How do I fix CVE-2026-123872?
No fix published yet.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-123872 being exploited?
There is no known exploitation of CVE-2026-123872 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-123872, BELL-CVE-2026-123872, DEBIAN-CVE-2026-123872, GHSA-v64j-2jhv-ww23, UBUNTU-CVE-2026-123872.