A hostname matching inconsistency in Node.js can allow an attacker to bypass the trust policy in a multi-context mTLS configuration, potentially granting unauthorized access to resources protected by that policy. The flaw falls under CWE‑284, reflecting improper access control, and under CWE‑289, indicating improper verification of the server certificate and its chain. The consequence is that code running in a validated TLS context may incorrectly trust an attacker’s certificate, leading to confidentiality or integrity violations.

Node.js versions 22, 24, and 26 are affected. The issue is present in all supported release lines, impacting any project that relies on bundled Node.js binaries or is installed from the official distribution.

The CVSS score of 4.2 indicates a moderate risk, and because the EPSS score is less than 1% the likelihood of exploitation is currently unclear. The vulnerability is not listed in the CISA KEV catalog. The attack requires an environment that uses multi-context mTLS, and to succeed an attacker would need to establish an mTLS connection with a hostname that triggers the mismatch logic. Based on the description, the likely attack vector is via network connections to an application that has enabled multi-context TLS; no public exploitation evidence has been reported.