What is the CVSS score of CVE-2026-58040?

CVE-2026-58040 has a CVSS 3.0 base score of 6.3 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-58040?

Yes, a patch is available for CVE-2026-58040. Update the affected software to the latest version immediately.

Node.js CVE-2026-58040

EUVD-2026-51017 MEDIUM

Improper Validation of Certificate with Host Mismatch (CWE-297)

2026-07-29

GHSA-r5cq-rcm7-54x2

Information Disclosure

6.3

CVSS 3.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.3 MEDIUM

Network vector for HTTPS; AC:H for required session-cache timing condition; PR:L for shared-agent access; S:C because session confusion crosses connection identity boundaries exposing third-party data.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.3 MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 30, 2026 - 08:41 vuln.today

Analysis Generated

Jul 30, 2026 - 08:41 vuln.today

CVSS changed

Jul 30, 2026 - 06:37 NVD

6.3 (MEDIUM)

CVE Published

Jul 29, 2026 - 14:02 github-releases

MEDIUM 6.3

CVE Published

Jul 29, 2026 - 14:02 github-releases

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

HTTPS session reuse in Node.js 22.x, 24.x, and 26.x fails to bind identity checks to reused TLS sessions, enabling a low-privileged attacker with access to a shared HTTPS agent context to obtain confidential data across session boundaries. Rated CVSS 6.3 Medium with Scope:Changed and C:H, reflecting the cross-connection identity confusion impact even though the attack is gated behind AC:H and PR:L. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

The vulnerability resides in Node.js's built-in https module, specifically in how the HTTPS agent manages TLS session resumption. TLS session resumption-via session tickets or session IDs-is a performance optimization that reuses previously negotiated cryptographic parameters to skip the full TLS handshake. Node.js's https.Agent caches and reuses these sessions across connections. The flaw, as named in commit 'https: bind identity checks to session reuse', is that hostname verification and certificate identity checks were not re-enforced when a cached TLS session was reused-allowing a session established with one server identity to be applied to a connection targeting a different identity. This constitutes a session confusion vulnerability. Affected release lines are Node.js 22.x (≤22.23.1), 24.x (≤24.18.0), and 26.x (≤26.5.0), per EUVD-2026-51017. No CWE has been formally assigned in available data.

RemediationAI

Upgrade to Node.js 26.5.1 (Current), confirmed as the patched release via the official GitHub release at https://github.com/nodejs/node/releases/tag/v26.5.1 dated 2026-07-29. Patched versions for the 22.x and 24.x LTS release lines are not explicitly named in the available data-consult the Node.js July 2026 security advisory at https://nodejs.org/en/blog/vulnerability/july-2026-security-releases for the exact fix versions on those branches. As an immediate compensating control where upgrading is impractical, disable HTTPS agent session reuse by setting agent: false or instantiating a fresh https.Agent per outbound request; this eliminates the vulnerable session cache behavior but increases TLS handshake overhead and latency, which may be significant in high-throughput backend-to-backend communication patterns.

Same weakness CWE-297 – Improper Validation of Certificate with Host Mismatch

View all

CVE-2025-46408 CRITICAL POC

9.8

CVE-2017-2911 MEDIUM POC

5.9

CVE-2017-2912 MEDIUM POC

5.9

CVE-2026-59638 CRITICAL

9.3

CVE-2025-15079 MEDIUM POC

5.3

CVE-2026-15925 CRITICAL

9.2

CVE-2026-48144 CRITICAL

9.1

CVE-2025-68637 CRITICAL

9.1

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Affected
SUSE Linux Enterprise High Performance Computing 12	Affected

CVE-2026-58040 vulnerability details – vuln.today

Back

Node.js CVE-2026-58040

Severity by source

CVSS VectorVendor

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-297 – Improper Validation of Certificate with Host Mismatch

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code