All vulnerabilities
CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects N

nodejs nodeRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published30 Jul 2026Updated 30 Jul 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 30 Jul 2026, 06:02 UTCPublishedCVE List
  2. 23 Oct 2026, 23:44 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Text from CVE List

Affected versions 3

  • nodeaffected: 22.23.1 through 22.23.1CVE List
  • nodeaffected: 24.18.0 through 24.18.0CVE List
  • nodeaffected: 26.5.0 through 26.5.0CVE List

References 1