Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
52
CVE-2026-123867
mTLS authorization bypass in Node.js CA-only SNI contexts
- CVSS 3.0
- 4.2 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Node.js fails to install a per-host client CA when an SNI context is added with a CA but no server certificate, so the handshake uses the default client CA. A network client holding a certificate trusted only by that default CA can complete mTLS to the protected hostname and read its response, even with requestCert and rejectUnauthorized set. Clients certified only by the protected CA are still rejected. Node.js 26.x, 24.x, and 22.x are affected; fixed versions are not stated.
What to do: Apply the Node.js project's November 11 security release for CVE-2026-123867.
| Product | Affected |
|---|---|
| Node.js | 26.x, 24.x, and 22.x |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context's CA only when setSniContext succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Weakness
- CWE-295
- Vector
- CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N