A flaw in Node.js HTTPS Agent connection reuse causes PFX object-array key collisions, enabling mutual TLS (mTLS) client identities to be reused across requests that are configured with different client certificates. This allows an attacker to impersonate a legitimate client and gain unauthorized access to protected resources, potentially leading to confidentiality and integrity breach. The weakness is classified as Authentication Failure (CWE‑287) and improper credential or key management (CWE‑303).

Node.js runtimes version 26.x, 24.x, and 22.x are affected. Servers, APIs, and services running these Node.js releases that make outbound HTTPS client connections with mTLS are at risk.

The vulnerability has a CVSS score of 4.1, indicating a moderate impact, and an EPSS score of less than 1%, suggesting low exploitation probability. It is not listed in CISA KEV. The likely attack vector relies on the ability of an attacker to influence HTTPS client requests—either by compromising the application code, submitting crafted requests to the Node.js process, or manipulating certificate selection. Given the low EPSS and moderate CVSS, the risk is considered low to moderate.