CVE-2020-8172

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and ...

7.4 HighFix available

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

6.07%Up 4.4 points since Apr 14, 2021

What each source reports

NVD Score used 7.4

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Record: CVE-2020-8172
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-295
Updated: 2026-11-02

CVE List No score

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Record: CVE-2020-8172
Updated: 2026-11-02

EUVDEUVD-2020-29056 No score

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Record: EUVD-2020-29056
Updated: 2026-11-03

GitHub AdvisoriesGHSA-98vx-jqrx-7mq2 7.4

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and ...

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Record: GHSA-98vx-jqrx-7mq2
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSVALPINE-CVE-2020-8172 7.4

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Record: ALPINE-CVE-2020-8172
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-03

OSVBELL-CVE-2020-8172 7.4

CVE-2020-8172 does not affect BellSoft software

Record: BELL-CVE-2020-8172
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Show 11 moreShow less

OSV 7.4

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Record: CVE-2020-8172
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2020:2847 8.1

Red Hat Security Advisory: nodejs:12 security update

Record: RHSA-2020:2847
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:2852 8.1

Red Hat Security Advisory: nodejs:12 security update

Record: RHSA-2020:2852
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:2895 8.8

Red Hat Security Advisory: rh-nodejs12-nodejs security update

Record: RHSA-2020:2895
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2020:2852 8.1

Important: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.2).

Security Fix(es):

nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)
nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload (CVE-2020-7598)
nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)
nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2020:2852
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-8172 7.4

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Record: UBUNTU-CVE-2020-8172
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVALSA-2020:2852 No score

Important: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.2).

Security Fix(es):

nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)
nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload (CVE-2020-7598)
nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)
nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2020:2852
Updated: 2026-11-02

OSVBIT-node-2020-8172 No score

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Record: BIT-node-2020-8172
Updated: 2026-11-02

OSVBIT-node-min-2020-8172 No score

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Record: BIT-node-min-2020-8172
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11096-1 No score

nodejs14-14.17.5-1.2 on GA media

These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11096-1
Updated: 2026-11-02

OSVSUSE-SU-2020:1606-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

nodejs12 was updated to version 12.18.0

CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).
CVE-2020-8172: Fixed am issue where TLS session reuse could have led to host certificate verification bypass (bsc#1172441).
CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).

npm was updated to 6.13.6

CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

Record: SUSE-SU-2020:1606-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nodejs` Alpine:v3.11	before 12.20.1-r0	12.20.1-r0
`nodejs` Alpine:v3.12	before 12.18.3-r0	12.18.3-r0
`nodejs` Alpine:v3.13	before 12.18.0-r0	12.18.0-r0
`nodejs` Alpine:v3.14	before 12.18.0-r0	12.18.0-r0
`nodejs` Alpine:v3.15	before 12.18.0-r0	12.18.0-r0
`nodejs` Alpine:v3.16	before 12.18.0-r0	12.18.0-r0
`nodejs` Alpine:v3.17	before 12.18.0-r0	12.18.0-r0
`nodejs` Alpine:v3.18	before 12.18.0-r0	12.18.0-r0
`nodejs` Alpine:v3.19	before 12.18.0-r0	12.18.0-r0
`nodejs` Alpine:v3.20	before 12.18.0-r0	12.18.0-r0

Show 51 moreShow less

Affected packages
Package	Affected	Fixed
`nodejs` Alpine:v3.21	before 12.18.0-r0	12.18.0-r0
`nodejs` Alpine:v3.22	before 12.18.0-r0	12.18.0-r0
`nodejs` Alpine:v3.23	before 12.18.0-r0	12.18.0-r0
`nodejs` Alpine:v3.24	before 12.18.0-r0	12.18.0-r0
`nodejs-current` Alpine:v3.12	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.13	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.14	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.15	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.16	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.17	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.18	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.19	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.20	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.21	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.22	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.23	before 14.4.0-r0	14.4.0-r0
`nodejs-current` Alpine:v3.24	before 14.4.0-r0	14.4.0-r0
`nodejs-nodemon` AlmaLinux:8 From an advisory covering 4 CVEs	before 1.18.3-1.module_el8.3.0+2023+d2377ea3	1.18.3-1.module_el8.3.0+2023+d2377ea3
`nodejs-nodemon` AlmaLinux:8 From an advisory covering 4 CVEs	before 1.18.3-1.module_el8.3.0+2047+b07ac28e	1.18.3-1.module_el8.3.0+2047+b07ac28e
`nodejs-packaging` AlmaLinux:8 From an advisory covering 4 CVEs	before 17-3.module_el8.4.0+2224+b07ac28e	17-3.module_el8.4.0+2224+b07ac28e
`nodejs-packaging` AlmaLinux:8 From an advisory covering 4 CVEs	before 17-3.module_el8.4.0+2521+c668cc9f	17-3.module_el8.4.0+2521+c668cc9f
`nodejs-packaging` AlmaLinux:8 From an advisory covering 4 CVEs	before 17-3.module_el8.3.0+2023+d2377ea3	17-3.module_el8.3.0+2023+d2377ea3
`node` Bitnami	12.0.0 up to 12.18.0, 14.0.0 up to 14.4.0	12.18.014.4.0
`node-min` Bitnami	12.0.0 up to 12.18.0, 14.0.0 up to 14.4.0	12.18.014.4.0
`nodejs` Red Hat:rhel_eus:8.1::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5	1:12.18.2-1.module+el8.1.0+7232+f8b5ede5
`nodejs-debuginfo` Red Hat:rhel_eus:8.1::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5	1:12.18.2-1.module+el8.1.0+7232+f8b5ede5
`nodejs-debugsource` Red Hat:rhel_eus:8.1::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5	1:12.18.2-1.module+el8.1.0+7232+f8b5ede5
`nodejs-devel` Red Hat:rhel_eus:8.1::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5	1:12.18.2-1.module+el8.1.0+7232+f8b5ede5
`nodejs-docs` Red Hat:rhel_eus:8.1::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5	1:12.18.2-1.module+el8.1.0+7232+f8b5ede5
`nodejs-full-i18n` Red Hat:rhel_eus:8.1::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5	1:12.18.2-1.module+el8.1.0+7232+f8b5ede5
`nodejs-nodemon` Red Hat:rhel_eus:8.1::appstream From an advisory covering 4 CVEs	before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45	0:1.18.3-1.module+el8.1.0+3369+37ae6a45
`nodejs-packaging` Red Hat:rhel_eus:8.1::appstream From an advisory covering 4 CVEs	before 0:17-3.module+el8.1.0+3369+37ae6a45	0:17-3.module+el8.1.0+3369+37ae6a45
`npm` Red Hat:rhel_eus:8.1::appstream From an advisory covering 4 CVEs	before 1:6.14.5-1.12.18.2.1.module+el8.1.0+7232+f8b5ede5	1:6.14.5-1.12.18.2.1.module+el8.1.0+7232+f8b5ede5
`nodejs` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.2.0+7233+61d664c1	1:12.18.2-1.module+el8.2.0+7233+61d664c1
`nodejs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.2.0+7233+61d664c1	1:12.18.2-1.module+el8.2.0+7233+61d664c1
`nodejs-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.2.0+7233+61d664c1	1:12.18.2-1.module+el8.2.0+7233+61d664c1
`nodejs-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.2.0+7233+61d664c1	1:12.18.2-1.module+el8.2.0+7233+61d664c1
`nodejs-docs` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.2.0+7233+61d664c1	1:12.18.2-1.module+el8.2.0+7233+61d664c1
`nodejs-full-i18n` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 1:12.18.2-1.module+el8.2.0+7233+61d664c1	1:12.18.2-1.module+el8.2.0+7233+61d664c1
`nodejs-nodemon` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45	0:1.18.3-1.module+el8.1.0+3369+37ae6a45
`nodejs-packaging` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:17-3.module+el8.1.0+3369+37ae6a45	0:17-3.module+el8.1.0+3369+37ae6a45
`npm` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 1:6.14.5-1.12.18.2.1.module+el8.2.0+7233+61d664c1	1:6.14.5-1.12.18.2.1.module+el8.2.0+7233+61d664c1
`rh-nodejs12-nodejs` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:12.18.2-1.el7	0:12.18.2-1.el7
`rh-nodejs12-nodejs-debuginfo` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:12.18.2-1.el7	0:12.18.2-1.el7
`rh-nodejs12-nodejs-devel` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:12.18.2-1.el7	0:12.18.2-1.el7
`rh-nodejs12-nodejs-docs` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:12.18.2-1.el7	0:12.18.2-1.el7
`rh-nodejs12-npm` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:6.14.5-12.18.2.1.el7	0:6.14.5-12.18.2.1.el7
`nodejs-nodemon` Rocky Linux:8 From an advisory covering 4 CVEs	before 0:1.18.3-1.module+el8.3.0+101+f84c7154	0:1.18.3-1.module+el8.3.0+101+f84c7154
`nodejs-packaging` Rocky Linux:8 From an advisory covering 4 CVEs	before 0:17-3.module+el8.3.0+101+f84c7154	0:17-3.module+el8.3.0+101+f84c7154
`nodejs12` SUSE:Linux Enterprise Module for Web and Scripting 12 From an advisory covering 4 CVEs	before 12.18.0-1.14.1	12.18.0-1.14.1
`nodejs14` openSUSE:Tumbleweed From an advisory covering 19 CVEs	before 14.17.5-1.2	14.17.5-1.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected	OSV
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-8172 is a high vulnerability (CVSS 7.4) in Nodejs Node.js, published June 8, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.07%, the 93rd percentile. Fixed in nodejs 12.20.1-r0.

References

Show 71 moreShow less