CVE-2026-25651
📋 TL;DR
The client-certificate-auth middleware for Node.js contains an open redirect vulnerability in versions 0.2.1 and 0.3.0. It unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing attackers to redirect users to malicious domains. This affects any Node.js application using these vulnerable versions of the middleware.
💻 Affected Systems
- client-certificate-auth
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could redirect users to phishing sites that steal credentials or deliver malware, potentially leading to account compromise, data theft, or system infection.
Likely Case
Users are redirected to malicious sites for phishing, credential harvesting, or malware distribution campaigns.
If Mitigated
With proper validation and patching, redirects only occur to legitimate HTTPS endpoints of the intended application.
🎯 Exploit Status
Exploitation requires sending HTTP requests with malicious Host headers to trigger redirects.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.0
Vendor Advisory: https://github.com/tgies/client-certificate-auth/security/advisories/GHSA-m4w9-gch5-c2g4
Restart Required: Yes
Instructions:
1. Update package.json to require client-certificate-auth version 1.0.0 or higher. 2. Run npm update client-certificate-auth. 3. Restart the Node.js application.
🔧 Temporary Workarounds
Disable HTTP-to-HTTPS redirection
allTemporarily disable the middleware's automatic HTTP-to-HTTPS redirection feature.
Configure middleware with {redirect: false} option
Implement Host header validation
allAdd custom middleware to validate Host headers before the vulnerable middleware runs.
app.use((req, res, next) => { if (!isValidHost(req.headers.host)) return res.status(400).send(); next(); })
🧯 If You Can't Patch
- Implement reverse proxy with strict Host header validation
- Use WAF rules to block malicious redirect patterns
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for client-certificate-auth version 0.2.1 or 0.3.0.Check Version:
npm list client-certificate-authVerify Fix Applied:
Confirm client-certificate-auth version is 1.0.0 or higher in package.json and node_modules.📡 Detection & Monitoring
Log Indicators:
- HTTP 301/302 redirects to unexpected domains
- Requests with unusual Host headers
Network Indicators:
- HTTP traffic showing redirects to non-application domains
SIEM Query:
http.status_code IN (301, 302) AND NOT url.destination IN (allowed_domains)