An incomplete fix in Node.js causes the HTTPS Agent to skip hostname verification when TLS sessions are reused across identity policies. This flaw allows an attacker who obtains or replays a TLS session to present a certificate for a different hostname without the agent detecting the mismatch, enabling potential man‑in‑the‑middle or spoofing attacks. The vulnerability could therefore lead to interception or tampering of HTTPS traffic if the attacker controls DNS or the network path.

The flaw affects the Node.js runtime in versions 22.x, 24.x, and 26.x.

The CVSS score of 6.3 indicates a medium severity threat. The EPSS score of less than 1% suggests that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, leveraging standard HTTPS connections in applications that reuse TLS sessions. No additional exploitation prerequisites are documented, so any Node.js application that utilizes the default HTTPS Agent is potentially at risk.