What is the CVSS score of EUVD-2026-51020?

EUVD-2026-51020 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-51020?

Yes, a patch is available for EUVD-2026-51020. Update the affected software to the latest version immediately.

Node.js EUVD-2026-51020

| CVE-2026-56850 MEDIUM

Improper Authentication (CWE-287)

2026-07-29

GHSA-777r-4cwx-g26v

Authentication Bypass Node.js Node Js

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

4.1 MEDIUM

Local vector and high privileges required to control HTTPS agent PFX config; high complexity for specific object/array collision condition; no confidentiality or availability impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

4.1 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

Red Hat

4.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Aug 25, 2026 - 18:07 NVD

4.1 (MEDIUM) 4.4 (MEDIUM)

Source Code Evidence Fetched

Jul 30, 2026 - 08:40 vuln.today

Analysis Generated

Jul 30, 2026 - 08:40 vuln.today

CVSS changed

Jul 30, 2026 - 06:37 NVD

4.1 (MEDIUM)

CVE Published

Jul 29, 2026 - 14:02 github-releases

UNKNOWN (no severity yet)

CVE Published

Jul 29, 2026 - 14:02 github-releases

MEDIUM 4.1

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

HTTPS agent connection pooling in Node.js fails to distinguish PFX credentials when encoded as an object versus an array, enabling authentication bypass under specific mutual-TLS configurations. Affected are Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. A high-privileged local actor who controls HTTPS agent configuration can induce the runtime to reuse a TLS session authenticated with one PFX credential for a request that should require a different (or no) credential, undermining certificate-based identity verification. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Node.js exposes an HTTPS Agent class that manages persistent TLS connection pools. When creating a pool lookup key, the agent serializes options - including the PFX field - to determine whether an existing authenticated session can be reused. CWE-287 (Improper Authentication) identifies the root cause: the key generation logic failed to canonicalize PFX credentials that arrive as a plain object versus an array of objects (both are valid Node.js API inputs for client certificates). This means two distinct PFX identities could hash to the same agent key, causing the connection pool to return an already-authenticated socket for a connection that should have required a different certificate. Affected CPE data from EUVD covers Node.js 22 ≤22.23.1, Node.js 24 ≤24.18.0, and Node.js 26 ≤26.5.0.

RemediationAI

Upgrade to Node.js 26.5.1 (Current line) as the confirmed patched release, per the vendor security release published 2026-07-29 at https://github.com/nodejs/node/releases/tag/v26.5.1. Corresponding patched versions for the LTS lines (22.x and 24.x) are expected in the same July 2026 security release cycle - consult https://nodejs.org/en/blog/vulnerability/july-2026-security-releases for confirmed fix versions for those lines, as exact LTS patch versions are not independently confirmed from the available data. As a compensating control where immediate upgrade is not possible, restrict or disable HTTPS Agent connection reuse in code paths that rely on per-request PFX client certificates by setting agent: false on sensitive requests; this prevents session reuse entirely but increases connection overhead. Ensure high-privilege access to Node.js process configuration is tightly controlled via OS-level access controls to reduce the attack surface.

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-287 – Improper Authentication

View all

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2020-0688 HIGH POC

8.8

CVE-2023-46805 HIGH POC

8.2

CVE-2023-35078 CRITICAL POC

9.8

CVE-2015-1187 CRITICAL POC

9.8

CVE-2024-7593 CRITICAL POC

9.8

CVE-2017-7921 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Affected
SUSE Linux Enterprise High Performance Computing 12	Affected

EUVD-2026-51020 vulnerability details – vuln.today

Back

Node.js EUVD-2026-51020

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-287 – Improper Authentication

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code