CVE-2026-84197

In Eclipse Ditto's Node.js JavaScript client, the WebSocket transport hard-codes rejectUnauthorized: false when creating the underlying ws WebSocket, so certificate chain and hostname validation are disabled for every wss:// connection and no builder option, constructor argument, or environment variable can turn validation back on. The flaw is triggered whenever an application using either affected npm package connects to a Ditto instance over wss:// while an attacker is positioned to intercept the traffic (CVSS 4.0 critical, 9.2, with attack requirements reflecting that intercepting position). The attacker can present an arbitrary certificate, complete the TLS handshake, read the credentials that the configured authentication provider sends in the Authorization header of the WebSocket upgrade request, and read, alter, or inject Ditto Protocol messages for the lifetime of the connection. Only the Node.js client's WebSocket transport is affected — the Java client, the browser/DOM JavaScript client, and the Node.js HTTP transport are unaffected. There is no known public PoC, the CVE is not in CISA KEV, and EPSS assigns roughly a 0.2% probability of exploitation within 30 days.

What to do: Audit whether any Node.js services use @eclipse-ditto/ditto-javascript-client-node or its _1.0 predecessor for wss:// connections; Java, browser/DOM, and HTTP transports need no action. Until Eclipse publishes a patched release (no fixed version is named in the current data), restrict the network path between affected applications and their Ditto instance to trusted links such as a VPN, private network, or controlled proxy, since the flaw cannot be disabled from application configuration. Watch the Eclipse advisory for a fixed version and upgrade promptly when it is available.