Client Certificate Auth
1 CVEs
product
Monthly
Client-certificate-auth middleware for Node.js versions 0.2.1 and 0.3.0 fails to validate the Host header when redirecting HTTP requests to HTTPS, enabling attackers to craft malicious redirects that direct users to arbitrary domains. Public exploit code exists for this open redirect vulnerability, and no patch is currently available for affected versions.
Node.js
Tls
Open Redirect
Client Certificate Auth
NVD
GitHub
CVSS 3.1
6.1
EPSS
0.0%
CVE-2026-25651
EPSS 0%
CVSS 6.1
MEDIUM
POC
PATCH
This Month
Client-certificate-auth middleware for Node.js versions 0.2.1 and 0.3.0 fails to validate the Host header when redirecting HTTP requests to HTTPS, enabling attackers to craft malicious redirects that direct users to arbitrary domains. Public exploit code exists for this open redirect vulnerability, and no patch is currently available for affected versions.
Node.js
Tls
Open Redirect
+1
NVD
GitHub