A flaw in Node.js TLS host verification allows an attacker to bypass certificate validation, potentially enabling man‑in‑the‑middle attacks or impersonation of trusted servers. The vulnerability can compromise the confidentiality and integrity of data transmitted over TLS connections. It results in a moderate CVSS score of 4.3, indicating a non‑critical but still meaningful risk to applications relying on Node.js for secure communication.

All supported release lines of Node.js are impacted, specifically Node.js 22, Node.js 24, and Node.js 26. The flaw exists in the core TLS implementation and applies to any application using the default certificate validation behavior.

The CVSS score reflects moderate severity. The EPSS score is below 1 %, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploits yet. vector requires an attacker to establish a TLS session with the vulnerable Node.js instance, possibly over a network connection, to exploit the host verification bypass. While the exact exploitation process is not described, the risk remains that an attacker could hijack traffic if the application trusts unverified certificates.