CVE-2026-58040

Published: Lug 30, 2026 Last Modified: Lug 30, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,3
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).

This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

https://nodejs.org/en/blog/vulnerability/july-2026-security…
https://nodejs.org/en/blog/vulnerability/july-2026-security-releases