Summary
Mixed-case SNI can bypass mTLS trust policies. This medium-severity finding affects Node.js.
Disclosure timeline
- Public disclosure
Credits
Cantina · Agent-discovered and human-verified
Vulnerability disclosure
Mixed-case SNI can bypass mTLS trust policies
CVE-2026-48928
- Affected product
- Node.js
- Severity
- Medium
- Weakness
- CWE-178
- Disclosed