🎯 New Report #3812439: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)
🔺Severity: Medium
👽 Reporter: vnyuh
⭐️ Reputation: 374
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-19
⏰ Disclosed: 2026-07-30 02:09:47
📝 Summary: A vulnerability was identified in Node.js where HTTPS Agent TLS session reuse skipped hostname verification across identity policies, which was an incomplete fix for CVE-2026-48934. This affected Node.js versions 22.x, 24.x, and 26.x.
📂 Report JSON File: 3812439
@hackeronereports