Improper Certificate Validation Affecting nodejs package, versions [22.20.0,]
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CONAN-NODEJS-17674619
- published29 Jun 2026
- disclosed26 Jun 2026
- credit3d7omb
Introduced: 26 Jun 2026
NewCVE-2026-48934 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Improper Certificate Validation in TLSSocket.prototype.setSession (lib/internal/tls/wrap.js), which reuses a cached TLS session for a connection with a different servername without re-verifying the server's certificate against the new host. An attacker can cause a client to accept a TLS connection to a server that does not hold a valid certificate for the requested host, bypassing certificate validation and establishing unauthorized connections, by inducing it to resume a session that was authenticated for a different servername. Exploitation affects clients that reuse TLS sessions across connections and requires the attacker to influence the servername bound to a resumed session, so that a session authenticated for one host is accepted for another.