Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Impact | CVSS 9.1. MITM vulnerability in a Node.js module used for network communications. |
| Exploit ScenarioDerived | Attacker performs MITM on connections made through node-To, intercepts or modifies data in transit due to lack of certificate validation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Improper certificate validation in Ayms node-To master Node.js module. The application does not properly validate TLS certificates, enabling man-in-the-middle attacks.
Earlier versions of this analysis (1)
TLS certificate validation bypass in node-To Node.js module.
RemediationAI
Update the module. Ensure TLS certificate validation is properly configured.
Affected ProductsAI
Ayms node-To master
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-295 improper certificate validation. The module fails to verify TLS certificate authenticity, accepting self-signed or invalid certificates.
Know when TLS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in TLS socket options
Executive ViewAI
A critical vulnerability in Ayms node-To master disables TLS/SSL certificate validation, allowing attackers to intercept encrypted communications and compromise data confidentiality and integrity. Any organization using this component faces immediate risk of man-in-the-middle attacks, credential theft, and unauthorized data access. This requires urgent remediation due to the absence of an available patch.
Implement network segmentation to restrict affected services to internal-only communication; deploy WAF rules to monitor and block suspicious TLS handshakes; enforce mutual TLS (mTLS) authentication at the network layer; restrict outbound connections from affected systems to whitelisted endpoints; consider disabling the affected feature or component if business-critical functionality permits; monitor network traffic for certificate validation bypass indicators; implement certificate pinning at the application layer if feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
MajorDoMo home automation platform is vulnerable to unauthenticated remote code execution through supply chain compromis
Unauthenticated backup download and RCE in Nginx UI before 2.3.3. EPSS 1.0%. PoC available.
FastCGI path splitting vulnerability in Caddy before 2.11.1 allows request smuggling or path confusion when proxying to
TLS error swallowing in Caddy web server before 2.11.1 allows bypassing client certificate authentication. Errors in Cli
Host header case sensitivity bypass in Caddy before 2.11.1. Virtual host routing can be bypassed by using alternate casi
Case sensitivity bypass in Caddy web server path matching before 2.11.1. HTTP path matchers can be bypassed using altern
Alist file manager has an improper certificate validation vulnerability allowing MITM attacks that could compromise file
Caddy versions 2.10.0 through 2.11.1 fail to strip client-supplied headers in the forward_auth copy_headers directive, e
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS ce
Caddy versions 2.7.5 through 2.11.1 contain a template injection vulnerability in the vars_regexp matcher that allows re
SumatraPDF versions 3.5.0 through 3.5.2 fail to validate TLS certificates during software updates and execute installers
EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's
Exploit-DB