地图 / HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)

HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)

密码学缺陷 / Exploiting Incorrectly Configured SSL/TLS / #3812439

厂商: Node.js
严重程度: 低危 · CVSS 6.3
赏金: —
弱点: Exploiting Incorrectly Configured SSL/TLS
研究员: @vnyuh
披露日期: 2026-07-30
资产: https://github.com/nodejs/node
CVE: CVE-2026-58040

该报告还没有中文解读。

时间线

2026-06-19报告提交
2026-07-30公开披露

阅读 HackerOne 原文 ↗作者 @vnyuh · 版权归作者与 Node.js 所有

同类报告

TLS host identity verification bypass via session reuse with different servername leads to unauthorized connectionsNode.js · 2026-06-25