Node.js EUVD-2026-39613

Exploitation requires a Node.js TLS server actively configured with multiple SNI-differentiated contexts - specifically, use of the SNICallback mechanism or equivalent multi-certificate TLS server setup where different hostnames map to distinct TLS contexts or certificates. Single-certificate Node.js TLS deployments (no SNI context switching) are not affected. The attacker must be able to initiate a TLS ClientHello to the target server (PR:L - some baseline network access or credentials are required), and must have prior knowledge of a registered SNI hostname to craft a casing-variant. Attack Complexity is High (AC:H): the attacker must precisely know the server's SNI configuration to engineer the casing mismatch and achieve context bypass. Deployments where all TLS virtual hosts share a single wildcard certificate are also unaffected.

The CVSS 3.0 base score of 4.2 (Medium) accurately reflects the constrained real-world risk profile. AV:N confirms network reachability, but AC:H indicates that triggering the mismatch requires specific conditions - namely a server configured with multiple SNI-differentiated TLS contexts. PR:L means the attacker must establish a TLS connection, implying some baseline access. The impact ceiling is low: C:L and I:L with no availability dimension. No EPSS score was provided in the input, and no KEV listing exists, so widespread opportunistic exploitation is not a confirmed signal. The Authentication Bypass tag accurately characterizes the nature of the bypass (wrong context = wrong certificate selection), but the practical consequence is bounded by the rarity of exploitable multi-SNI deployments and the PR:L requirement. This vulnerability should be patched as part of the standard Node.js upgrade cycle rather than treated as an emergency; however, operators running Node.js TLS servers with SNI-based virtual hosting should prioritize the upgrade given the targeted bypass potential.

An attacker with access to a network-reachable Node.js TLS server - one that uses SNI-based context switching to serve different certificates for different virtual hostnames - sends a TLS ClientHello in which the SNI extension contains a hostname with non-standard casing, such as 'Api.EXAMPLE.COM' instead of the registered 'api.example.com'. The Node.js tls module fails to normalize this value before context lookup, causing a miss against the intended context and falling back to a default or alternative TLS context. The attacker can then interact with the server under a different certificate or security policy than intended, enabling limited information disclosure or integrity manipulation of the TLS session metadata.