This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-58040 →
ALPINE-CVE-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix o...
Original description
The description as published by the source.
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.21
nodejs
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.2-r0"}]}]
Alpine:v3.22
nodejs
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.2-r0"}]}]
Alpine:v3.23
nodejs
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-r0"}]}]
Alpine:v3.24
nodejs
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.1-r0"}]}]
References
- advisory security.alpinelinux.org