# CVE-2026-25651: client-certificate — Fixed in 1.0.0

📦

📦 npm

Not in CISA KEV

MEDIUM severity

# CVE-2026-25651 — client-certificate-auth

MEDIUM [Fix: tgies/client-certificate-auth@8fc995e](https://github.com/tgies/client-certificate-auth/commit/8fc995e953db483495be46862965e50fe9e1cc52)

CVE-2026-25651 is a medium-severity (CVSS 6.1) Open Redirect vulnerability in client-certificate-auth. A fix is available for client-certificate-auth — see the affected versions and patch details below.

client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect

Also known as[GHSA-m4w9-gch5-c2g4](/vulnerability/GHSA-m4w9-gch5-c2g4)

Published

Feb 6, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-25651.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.2%probability of exploitation in next 30 days

Lower Risk\-0.00%

Lower risk than most CVEs8th percentile — riskier than 8% of all scored CVEsHighest risk

0.00%0.24%0.47%0.71%0.0%0.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

2other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

`client-certificate-auth`npm

457downloads / week

## Description

#### Summary

Versions 0.2.1 and 0.3.0 of `client-certificate-auth` contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated `Host` header, allowing an attacker to redirect users to arbitrary domains.

#### Vulnerable Code

```
// lib/clientCertificateAuth.js (versions 0.2.1, 0.3.0)
if (!req.secure && req.header('x-forwarded-proto') != 'https') {
  return res.redirect('https://' + req.header('host') + req.url);
}
```

#### Attack Scenario

1.  Attacker crafts a link: `http://vulnerable-app.example.com/login`
2.  When victim clicks, attacker intercepts and injects header: `Host: attacker.com`
3.  Server responds: `302 Found → https://attacker.com/login`
4.  Victim is redirected to attacker-controlled site

#### Impact

-   **Phishing**: Attackers can use trusted domain links to redirect victims to credential-harvesting pages
-   **OAuth/SSO Token Theft**: In authentication flows, authorization codes or tokens may leak via redirect
-   **Referer Leakage**: Sensitive URL parameters may be exposed to attacker domains via the Referer header
-   **Cache Poisoning**: In deployments with shared caches, malicious redirects may be cached and served to other users

#### Exploitability

Exploitation requires that HTTP traffic reaches the Node.js application without TLS termination setting `x-forwarded-proto: https`. This condition is uncommon in production deployments behind modern reverse proxies or load balancers, which limits real-world exploitability.

#### Fix

The vulnerable redirect behavior has been completely removed in version 1.0.0.

```
npm install client-certificate-auth@^1.0.0
```

#### Workarounds

If upgrading is not immediately possible:

1.  Block HTTP traffic at the network/load balancer level
2.  Ensure your reverse proxy always sets `x-forwarded-proto: https`
3.  Add middleware before `clientCertificateAuth` to validate the `Host` header against an allowlist

#### References

-   [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)
-   [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)
-   [Fix Commit](https://github.com/tgies/client-certificate-auth/commit/8fc995e953db483495be46862965e50fe9e1cc52)

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

📦npm

`client-certificate-auth` 

≥ 0.2.1&&< 1.0.0

1.0.0`npm install client-certificate-auth@1.0.0`

## Affected Products

1 product · 1 configurations

Application

`client-certificate-auth`tgies

≥ 0.2.1 && < 1.0.0

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for client-certificate-auth, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update client-certificate-auth to 1.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-25651 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
    

## Frequently Asked Questions

\### Summary Versions 0.2.1 and 0.3.0 of \`client-certificate-auth\` contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated \`Host\` header, allowing an attacker to redirect users to arbitrary domains. ### Vulnerable Code \`\`\`javascript // lib/clientCertificateAuth.js (versions 0.2.1, 0.3.0) if (!req.secure && req.header('x-forwarded-proto') != 'https') { return res.redirect('https://' + req.header('host') + req.url); } \`\`\` ### Attack Scenario 1. Attacker crafts a link: \`http://vulnerable-app.example.com/login\` 2. When vic

O3 Security · Impact-Aware SCA

### Is CVE-2026-25651 in your dependencies?

Find it across npm, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)