CVE-2026-58040

Node.js versions 22.x, 24.x, and 26.x are vulnerable due to an incomplete fix that allows the HTTPS Agent TLS session reuse to bypass hostname verification across identity policies. This could lead to potential man-in-the-middle attacks, compromising the integrity and confidentiality of data transmitted over HTTPS. Organizations using these Node.js versions should prioritize applying the necessary patches to mitigate this security risk.