🎯 New Report #3816840: HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates
🔺Severity: Medium
👽 Reporter: yottt
⭐️ Reputation: 457
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-22
⏰ Disclosed: 2026-07-29 14:45:08
📝 Summary: A flaw in Node.js HTTPS Agent connection reuse was discovered that could cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affected Node.js versions 26.x, 24.x, and 22.x.
📂 Report JSON File: 3816840
@hackeronereports